Collect SeekrFlow credentials and values

Gather everything on this page before you prepare the install. Request the credentials from Seekr early, because they can take time to arrive.

Request credentials

Store each credential using the approach you chose in Set up secret management.

From Seekr

Request these from your Seekr account team:

License key – Validated at startup by the License service. Pods don’t become ready without a valid key.
Registry credentials – A username and user token for Seekr’s registry, which you use to pull the chart and images. Tokens expire once a year. When yours expires, image pulls and upgrades fail with authentication errors until you get a new one.
Model configuration – A flowmodel.yaml file that defines which models to run on your GPU nodes and how to size them.

From third parties

Hugging Face access token – Required for every deployment. SeekrFlow also uses it to download gated model weights, which include most Llama variants. A free Hugging Face account includes an access token. For each gated model you run, accept its license on the model’s Hugging Face page, using the account that owns the token.
Brave Search API key – Lets agents run web searches. Without it, agents can’t search the web. Sign up for the Brave Search API, subscribe to the Data for Search API plan, which has a free tier, and generate a key from the developer dashboard.

Amazon Bedrock access

To use models hosted in Amazon Bedrock, make sure your cloud account can use each model before you configure it:

Amazon Bedrock – Most models are available without setup. Before you use an Anthropic model, submit the one-time use-case form in the Amazon Bedrock console. In Amazon Web Services (AWS) GovCloud (US), request access to each model in the console.

Record your values

Confirm you have every value in these tables. Each table also appears on the page where you create the resource. sfe bootstrap asks for most of these values when it generates your values file, and you enter the rest when you create secrets.

Cluster

From Provision the cluster.

Value	Used for	Example or format
Cluster name	`global.cloudProvider.clusterName`	`seekrflow-prod`
AWS Region, AWS only	`global.cloudProvider.aws.region`	`us-east-1`
Kubernetes context	Your `sfe` profile	The `kubectl` context for this cluster.
GPU node label	`global.defaults.gpuNodeLabel`	`nvidia.com/gpu.present: "true"`
Whether a JobSet controller is running	`jobset.enabled`	`true` only if you need multi-node fine-tuning and the cluster has no JobSet controller.

Networking

From Set up networking and cluster policies.

Amazon Web Services (AWS)
On-premises

Value	Used for	Example or format
Hostname	`global.ingress.host`	`seekrflow.example.com`
Ingress class	`global.ingress.className`	`"alb"`
Chart-managed or externally managed ingress	`global.ingress.enabled`	`true` for chart-managed ingress.
Load balancer annotations	`global.ingress.annotations`	SeekrFlow requires `target-type: ip` and HTTPS on port 443, and recommends a 300-second idle timeout. See Load balancer annotations.

Value	Used for	Example or format
Hostname	`global.ingress.host`	`seekrflow.example.com`
Ingress class	`global.ingress.className`	`"nginx"` or `"traefik"`
Chart-managed or externally managed ingress	`global.ingress.enabled`	`true` for chart-managed ingress.

PostgreSQL

From Provision PostgreSQL.

Value	Used for	Example or format
Instance hostname	`global.defaults.postgres.host`, and the `pg-creds` secret: `PG_HOST`	The endpoint of your database instance.
Port	`global.defaults.postgres.port`	`5432`
Admin account name and password	`pg-creds` secret: `PG_USER`, `PG_PASS`	The admin credentials you set when you created the instance. SeekrFlow uses them for migrations.
Application role password	`pg-creds` secret: `PG_APP_PASS`	The password you generated for `seekrflow_app`.
Keycloak role password, if you enable Keycloak	`keycloak-credentials` secret: `db-password`	The password you generated for `seekrflow_keycloak`.

OpenSearch

From Provision OpenSearch.

Amazon Web Services (AWS)
On-premises

Value	Used for	Example or format
Hostname	`global.defaults.opensearch.host`	Your domain endpoint.
Port	`global.defaults.opensearch.port`	`443` for Amazon OpenSearch Service, `9200` for OpenSearch you run yourself.
Scheme	`global.defaults.opensearch.scheme`	`"https://"`
Whether the chart deploys OpenSearch	`opensearch.enabled`	`false`. `sfe bootstrap` sets it to `true`, which you correct in Create the values file.

Value	Used for	Example or format
Whether the chart deploys OpenSearch	`opensearch.enabled`	`true`
Admin user	`opensearch-credentials` secret: `OPENSEARCH_USER`	`admin`. OpenSearch requires this name.
Admin password	`opensearch-credentials` secret: `OPENSEARCH_PASS`	The password you generated, or the one `sfe secrets create --auto-generate` creates.
Scheme	`global.defaults.opensearch.scheme`	`"https://"`

Storage

From Provision storage.

Amazon Web Services (AWS)
On-premises

Value	Used for	Example or format
Bucket name	`global.fileStorePath`	`seekrflow-data`, or `seekrflow-data/prod` with a path. Use the bare bucket name, without `s3://`.
Shared file storage type	`global.SharedModelCache.type`	`"efs"`
File system ID	`global.SharedModelCache.efs.fileSystemId`	`fs-0123456789abcdef0`

Value	Used for	Example or format
Bucket name	`global.fileStorePath`	`seekrflow-data`, or `seekrflow-data/prod` with a path. Use the bare bucket name, without a scheme such as `s3://`.
Object store endpoint	`global.cloudProvider.on-prem.storageEndpoint`	`http://minio.seekrflow.svc:9000`
Object store access keys	`appliance-storage-creds` secret: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`	Your MinIO access key and secret key.
Shared file storage type	`global.SharedModelCache.type`	`"nfs"` or `"longhorn"`
NFS server and path	`global.SharedModelCache.nfs.server`, `global.SharedModelCache.nfs.path`	Your NFS server hostname or IP address, and the exported path.
Existing Longhorn storage class	`global.SharedModelCache.createStorageClass`, `global.SharedModelCache.storageClassName`	`false` and `longhorn`

Cloud identity

From Set up cloud identity.

Value	Used for	Example or format
Role ARN, IAM roles for service accounts only	`global.cloudProvider.identity` annotation `eks.amazonaws.com/role-arn`	`arn:aws:iam::123456789012:role/seekrflow`. For Amazon EKS Pod Identity, leave `global.cloudProvider.identity` as `{}`. Setting the role ARN switches SeekrFlow’s workflow pods to IAM roles for service accounts, which fails without an OIDC provider.

Secret management

From Set up secret management.

Value	Used for	Example or format
Create the secret store	`global.Secrets.store.create`	`true`
Secret store provider	`global.Secrets.store.provider`	On AWS, the service and Region, such as `aws: {service: SecretsManager, region: us-east-1}`. For HashiCorp Vault, the server address and authentication.

Credentials

From the credentials you requested in Request credentials.

Value	Used for	Example or format
License key	`seekrflow-license` secret: `license_key`	A long token from your Seekr account team.
Registry username and token	The `seekrflow-artifacts-pull-access` image pull secret	From your Seekr account team.
Model configuration	Merged into your values file under `FlowModel.models`	The `flowmodel.yaml` file from your Seekr account team.
Hugging Face access token	`hf-token` secret: `HF_TOKEN`	Starts with `hf_`.
Brave Search API key	`brave-search-api-key` secret: `BRAVE_SEARCH_API_KEY`	From the Brave Search API developer dashboard.
External model IDs, optional	The model settings in Configure models	An `aws-bedrock:` model ID.

SeekrFlow Self-Managed

Plan a SeekrFlow deployment

Provision SeekrFlow dependencies

Prepare to install SeekrFlow

Deploy SeekrFlow

Operate SeekrFlow

Reference

Collect SeekrFlow credentials and values

Request credentials

From Seekr

From third parties

Amazon Bedrock access

Record your values

Cluster

Networking

PostgreSQL

OpenSearch

Storage

Cloud identity

Secret management

Credentials

​Request credentials

​From Seekr

​From third parties

​Amazon Bedrock access

​Record your values

​Cluster

​Networking

​PostgreSQL

​OpenSearch

​Storage

​Cloud identity

​Secret management

​Credentials

Request credentials

From Seekr

From third parties

Amazon Bedrock access

Record your values

Cluster

Networking

PostgreSQL

OpenSearch

Storage

Cloud identity

Secret management

Credentials