Deploying the Platform

This guide covers deploying the RootCause.ai platform components using Helm. The platform chart deploys three services that work together to power the application.

---

Platform Components

Component	Description	Technology
platform	Web UI and backend-for-frontend	Next.js
data-service	Core API for data processing and orchestration	FastAPI
ml-jobs	Headless compute for causal discovery and simulations	Python
data-fusion	FDAP layer	Rust, FDAP

These components communicate with each other and with the dependency services.

---

Prerequisites

Before deploying the platform:

1. Dependencies deployed – All services from the Dependencies guide running

2. Image pull secret – Access to the GitLab container registry

3. Secrets configured – API keys, connection strings, and credentials ready

---

Creating the Image Pull Secret

The platform images are hosted on GitLab's container registry:

kubectl create secret docker-registry regcred \
  --namespace=rootcause \
  --docker-server=registry.gitlab.com \
  --docker-username=<your-gitlab-username> \
  --docker-password=<your-gitlab-token>

---

Installation

From OCI Registry (Recommended)

Step 1: Login to Registry

helm registry login registry.gitlab.com \
  --username <your-gitlab-username> \
  --password <your-gitlab-token>

Step 2: Create Values File

Create production-values.yaml with your configuration:

global:
  namespace: rootcause

secrets:
  litellmConnection:
    LITELLM_API_LOCATION: "your-litellm-location"
    LITELLM_API_KEY: "your-litellm-key"

  percepturaGoogleCreds:
    GOOGLE_CLIENT_ID: "your-google-client-id"
    GOOGLE_CLIENT_SECRET: "your-google-client-secret"
    GMAIL_PASSKEY: "your-gmail-passkey"

  minioApiUser:
    MINIO_ACCESS_KEY: "your-minio-access-key"
    MINIO_SECRET_KEY: "your-minio-secret-key"

  fusionKeys:
    AUTH_SECRET: "your-auth-secret"
    FUSIONAUTH_APIKEY: "your-fusion-api-key"
    FUSIONAUTH_APPID: "your-fusion-app-id"
    FUSIONAUTH_TENANTID: "your-fusion-tenant-id"
    FUSIONAUTH_APP_SECRET: "your-fusion-app-secret"
    NEXTAUTH_JWT_SECRET: "your-nextauth-jwt-secret"

  percepturaRedis:
    REDIS_CONNECTION: "redis://your-redis-connection-string"

Step 3: Install

# Install latest version
helm install perceptura-platform \
  oci://registry.gitlab.com/perceptura/client-deployments/helm-charts-platform/helm/perceptura-platform \
  --namespace rootcause \
  --create-namespace \
  --values production-values.yaml

# Or install specific version
helm install perceptura-platform \
  oci://registry.gitlab.com/perceptura/client-deployments/helm-charts-platform/helm/perceptura-platform \
  --version 0.3.0 \
  --namespace rootcause \
  --values production-values.yaml

From Local Chart

# Update dependencies
helm dependency update ./perceptura-platform

# Install
helm install perceptura-platform ./perceptura-platform \
  --namespace perceptura \
  --create-namespace \
  --values production-values.yaml

---

Automatic Secret Management

The chart automatically manages several secrets:

MongoDB Connection

The helm chart allows you to set a password password and if it is left empty the chart will create new password.

MongoDB Encryption

Auto-generated if not provided:

• Secret: platform-mongo-encryption

• Keys: MONGO_ENCRYPTION_KEY (32 chars), MONGO_ENCRYPTION_IV (16 chars)

• Marked with helm.sh/resource-policy: keep to persist across upgrades

RabbitMQ Connection

References the secret created by RabbitMQ Cluster Operator:

• Secret: perceptura-rabbitmq-default-user

• Keys: host, port, username, password

---

Verifying Installation

# Check all platform resources
kubectl get all -l app.kubernetes.io/instance=perceptura-platform -n perceptura

# Check pods
kubectl get pods -l tier=web -n perceptura

# Check services
kubectl get svc -n perceptura | grep -E "(data-service|platform|ml-jobs|data-fusion)"

# Check ingress
kubectl get ingress -n perceptura

# View logs
kubectl logs -l app=platform -n perceptura --tail=100
kubectl logs -l app=data-service -n perceptura --tail=100

---

Health Checks

Each component exposes health endpoints:

Component	Health Endpoint
Platform	/api/health
Data Service	/health
ML Jobs	Internal (via RabbitMQ)
Data Fusion

---

RBAC Permissions

The platform service has RBAC permissions to manage jobs and pods:

# Automatically created by the chart
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: perceptura-platform-role
rules:
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "delete", "get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]

---

Next Steps

With the platform deployed:

• Configure Secrets and Environment Variables

• Set up Scaling for production workloads

• Review Upgrading procedures

• Configure SSO for user authentication