> ## Documentation Index
> Fetch the complete documentation index at: https://docs.emergence.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CRAFT Deployment Overview

> Deploy CRAFT on any Kubernetes cluster using Helm charts and ArgoCD GitOps. Supports GKE, EKS, AKS, and on-premises environments.

# Deployment Overview

Run CRAFT on any Kubernetes cluster. The platform uses **Helm charts** for application packaging and **ArgoCD** for GitOps-based continuous deployment across four environments: dev, staging, demo, and production.

<Info>
  CRAFT deploys on **your infrastructure**. The platform runs on any CNCF-conformant Kubernetes cluster -- GKE, EKS, AKS, or self-managed -- without cloud-specific dependencies. You choose where to run; the same Helm chart deploys across all environments, while provisioning steps vary by environment.
</Info>

## Supported Environments

<CardGroup cols={2}>
  <Card title="Google Kubernetes Engine" icon="google" iconType="brands">
    Deploy on GKE Autopilot or Standard clusters. Terraform modules automate cluster, VPC, IAM, and Secret Manager provisioning.
  </Card>

  <Card title="Amazon EKS" icon="aws" iconType="brands">
    Deploy on Amazon EKS with Helm charts. Terraform modules for automated provisioning are planned.
  </Card>

  <Card title="Azure AKS" icon="microsoft" iconType="brands">
    Deploy on Azure AKS with Helm charts. Terraform modules for automated provisioning are planned.
  </Card>

  <Card title="On-Premises" icon="server">
    Deploy on any CNCF-conformant cluster (v1.28+). No cloud-specific services required -- use self-hosted PostgreSQL, Redis, and MinIO.
  </Card>
</CardGroup>

## Helm Chart

The em-runtime Helm chart packages all platform services and their dependencies:

### Included Components

| Component      | Type                   | Purpose                                                                                                    |
| -------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Governance** | Deployment             | Identity, authorization, secrets management (port 8000)                                                    |
| **Assets**     | Deployment             | Artifacts, data connections, files, models (port 8000)                                                     |
| **Utils**      | Deployment             | Data catalog, search, scheduling, context packs, memories (port 8000)                                      |
| **PostgreSQL** | StatefulSet / External | Primary data store for all services                                                                        |
| **Redis**      | StatefulSet / External | Caching, messaging, event streaming                                                                        |
| **Keycloak**   | StatefulSet / External | Multi-realm JWT authentication                                                                             |
| **OpenFGA**    | Deployment / External  | Relationship-based access control                                                                          |
| **Infisical**  | Deployment / External  | Secrets management, one of two supported backends. See [Secrets Management](/security/secrets-management). |

### Deployment Modes

<Tabs>
  <Tab title="In-Cluster (Default)">
    All dependencies (PostgreSQL, Redis, Keycloak, OpenFGA) are deployed as part of the Helm release within the Kubernetes cluster.

    Best for:

    * Development and testing environments
    * Standalone deployments
    * Quick setup with minimal external dependencies
  </Tab>

  <Tab title="External Databases">
    PostgreSQL and Redis run outside the Kubernetes cluster (managed services or Docker). The Helm chart connects to them via configuration values.

    Best for:

    * Production environments with managed database services
    * Existing infrastructure reuse
    * Separation of stateful and stateless workloads
  </Tab>
</Tabs>

### Solution Integration

Solutions declare `em-runtime` as a **Helm subchart dependency** in their `Chart.yaml`. This ensures:

* Platform services are co-deployed with the solution
* Consistent Keycloak, OpenFGA, and database configuration
* Single `helm install` deploys the complete stack
* Version-pinned dependencies for reproducible deployments

## Service Startup Order

The Helm chart respects the required startup order via init containers and readiness probes:

```text theme={null}
PostgreSQL -> Redis -> Keycloak -> OpenFGA -> [Infisical] -> Governance -> Assets/Utils -> Solutions
```

<Note>
  Governance must complete its bootstrap process (initializing Keycloak realms and OpenFGA schema) before Assets, Utils, or any solution can start. If Governance is down, downstream services return 403 on all permission-checked endpoints.
</Note>

## Observability Stack

The deployment includes a full observability stack via the Grafana LGTM bundle:

| Component         | Purpose                                                |
| ----------------- | ------------------------------------------------------ |
| **OpenTelemetry** | OTLP-based traces, metrics, and logs from all services |
| **Loki**          | Log aggregation and querying                           |
| **Grafana**       | Dashboards and visualization                           |
| **Tempo**         | Distributed tracing                                    |
| **Mimir**         | Metrics storage and querying                           |

## Next Steps

<CardGroup cols={2}>
  <Card title="Helm Configuration" icon="gear" href="/deployment/helm/configuration">
    Customize the Helm chart values for your environment.
  </Card>

  <Card title="Observability" icon="chart-line" href="/deployment/observability/opentelemetry">
    Set up OpenTelemetry and the Grafana LGTM stack.
  </Card>

  <Card title="Networking" icon="network-wired" href="/deployment/infrastructure/networking">
    Gateway API, cert-manager, and DNS configuration.
  </Card>

  <Card title="Secrets Management" icon="key" href="/deployment/infrastructure/secrets">
    Configure ESO + GCP Secret Manager or Infisical.
  </Card>
</CardGroup>