> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up the sfe CLI

> Choose where to run commands, install the sfe CLI, save a profile, sign in to the registry, and mirror images if needed.

`sfe` is SeekrFlow's command-line tool. It generates your values file, creates SeekrFlow's secrets and databases, and installs and upgrades SeekrFlow. Set it up on the machine you run the rest of this guide from.

## Choose where to run commands

Run the rest of this guide from a machine that can reach the Kubernetes API and Seekr's registry. If your laptop can't reach the cluster's API, use a machine inside your network, such as a bastion host.

The identity you run commands as needs Kubernetes cluster-admin permissions. On Amazon Elastic Kubernetes Service (Amazon EKS), only the identity that created the cluster has them by default. Give any other identity an [access entry](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html).

On Amazon Web Services (AWS), `sfe` signs in with your AWS Command Line Interface (AWS CLI) credentials and needs a default Region. If `aws configure get region` prints nothing, set one:

```bash theme={null}
aws configure set region <region>
```

<Note>
  Installing with Helm is for experienced Helm and Kubernetes users who are building their own automation. If that's you, you need `sfe` only to mirror container images. Otherwise, follow this page to install `sfe`.
</Note>

## Install the sfe CLI

Download `sfe` from Seekr's registry with the registry username and token from your Seekr account team. Set `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` to those values, then follow the steps for your machine's operating system.

<Tabs>
  <Tab title="Linux">
    <Steps>
      <Step title="Download the binary">
        Replace `<version>` with the `sfe` version to install, such as `3.11.2`:

        ```bash theme={null}
        curl --fail -sSL -u "$REGISTRY_USERNAME:$REGISTRY_PASSWORD" -O "https://seekr.repo.sonatype.app/repository/seekr-raw-release/sfe-cli/<version>/sfe-linux-amd64"
        curl --fail -sSL -u "$REGISTRY_USERNAME:$REGISTRY_PASSWORD" -O "https://seekr.repo.sonatype.app/repository/seekr-raw-release/sfe-cli/<version>/SHA256SUMS"
        ```
      </Step>

      <Step title="Check the download">
        ```bash theme={null}
        sha256sum --ignore-missing -c SHA256SUMS
        ```

        The command prints `sfe-linux-amd64: OK`. If it reports `FAILED`, download the binary again.
      </Step>

      <Step title="Install the binary">
        ```bash theme={null}
        chmod +x sfe-linux-amd64
        sudo mv sfe-linux-amd64 /usr/local/bin/sfe
        ```
      </Step>

      <Step title="Confirm the version">
        ```bash theme={null}
        sfe --version
        ```
      </Step>
    </Steps>
  </Tab>

  <Tab title="macOS">
    <Steps>
      <Step title="Download the binary">
        Replace `<version>` with the `sfe` version to install, such as `3.11.2`:

        ```bash theme={null}
        curl --fail -sSL -u "$REGISTRY_USERNAME:$REGISTRY_PASSWORD" -O "https://seekr.repo.sonatype.app/repository/seekr-raw-release/sfe-cli/<version>/sfe-darwin-arm64"
        curl --fail -sSL -u "$REGISTRY_USERNAME:$REGISTRY_PASSWORD" -O "https://seekr.repo.sonatype.app/repository/seekr-raw-release/sfe-cli/<version>/SHA256SUMS"
        ```
      </Step>

      <Step title="Check the download">
        ```bash theme={null}
        shasum -a 256 --ignore-missing -c SHA256SUMS
        ```

        The command prints `sfe-darwin-arm64: OK`. If it reports `FAILED`, download the binary again.
      </Step>

      <Step title="Install the binary">
        ```bash theme={null}
        chmod +x sfe-darwin-arm64
        sudo mkdir -p /usr/local/bin
        sudo mv sfe-darwin-arm64 /usr/local/bin/sfe
        ```
      </Step>

      <Step title="Confirm the version">
        ```bash theme={null}
        sfe --version
        ```

        If macOS blocks `sfe` because Apple hasn't verified it, allow it, then run `sfe --version` again:

        ```bash theme={null}
        xattr -d com.apple.quarantine /usr/local/bin/sfe
        ```
      </Step>
    </Steps>
  </Tab>
</Tabs>

If you don't have admin rights on the machine, put `sfe` in a folder in your home directory that's on your `PATH` instead.

`sfe` doesn't need the `helm` or `aws` commands, but other steps in this guide do. For every tool the guide uses, see [Review SeekrFlow requirements](/self-managed/flow/plan/requirements#tools).

## Save a profile

A profile saves the settings you'd otherwise type on every `sfe` command.

<Steps>
  <Step title="Find your Kubernetes context">
    ```bash theme={null}
    kubectl config current-context
    ```

    Copy the name it prints.
  </Step>

  <Step title="Create the profile">
    Replace `<profile-name>` with a name for this deployment, such as `prod`:

    ```bash theme={null}
    sfe profile add <profile-name>
    ```

    `sfe` asks for each setting. Enter these values:

    | Setting | What to enter |
    | - | - |
    | Kube context | The name you copied in the previous step. |
    | Namespace | `seekrflow`, the default. |
    | Values file | The name you plan to give your values file, such as `my-values.yaml`. You create the file later. |
    | AWS profile | The profile `sfe` uses to sign in to Amazon Web Services (AWS). Leave it blank to use your default profile, or for on-premises deployments. |
    | Helm release name | `seekrflow`, the default. |
  </Step>

  <Step title="Check the profile">
    ```bash theme={null}
    sfe profile current -p <profile-name>
    ```

    The command prints the settings you entered.
  </Step>
</Steps>

Later commands in this guide use `-p <profile-name>` to apply these settings. Profiles don't save the release version. Add it with `-r` on each command.

## Sign in to the registry

Sign in with the same `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` you used to download `sfe`:

```bash theme={null}
echo "$REGISTRY_PASSWORD" | sfe chart login \
  --username "$REGISTRY_USERNAME" \
  --password-stdin
```

`sfe` signs in to Seekr's registry and saves the credentials for downloading the chart, installing, and upgrading.

## Mirror container images

If your cluster can't reach Seekr's registry, copy SeekrFlow's container images into a registry inside your network. You can also mirror them if you want your cluster to pull images only from your own registry.

The machine you mirror from needs to reach Seekr's registry and `registry.k8s.io`, which hosts the JobSet controller image.

<Steps>
  <Step title="Sign in to both registries">
    `sfe` reads registry sign-ins from Docker's credentials file, not from `sfe chart login`. Sign in to Seekr's registry and to your own:

    ```bash theme={null}
    echo "$REGISTRY_PASSWORD" | docker login seekr.repo.sonatype.app --username "$REGISTRY_USERNAME" --password-stdin
    docker login <your-registry>
    ```

    On Amazon Elastic Container Registry (Amazon ECR), skip the second command. `sfe` signs in to Amazon ECR with your AWS credentials.
  </Step>

  <Step title="Preview the copy">
    To see what `sfe` will copy, run:

    ```bash theme={null}
    sfe images mirror -r <version> --target-registry <your-registry> --dry-run
    ```
  </Step>

  <Step title="Copy the images">
    ```bash theme={null}
    sfe images mirror -r <version> --target-registry <your-registry>
    ```

    On Amazon ECR, each image needs its own repository. To create them as you copy, add `--create-missing-repos`. This requires the `ecr:CreateRepository` permission.
  </Step>

  <Step title="Confirm the copy">
    To confirm every image arrived, run:

    ```bash theme={null}
    sfe images verify -r <version> --registry <your-registry>
    ```

    To also confirm each copied image is identical to Seekr's original, run:

    ```bash theme={null}
    sfe images compare -r <version> --target-registry <your-registry>
    ```
  </Step>

  <Step title="Point SeekrFlow at your registry">
    Set `global.repository` in your values file to your registry. Every image in the chart pulls from there, including images for supporting components such as MLflow and Argo Workflows.
  </Step>
</Steps>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.