> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Collect SeekrFlow credentials and values

> Request the credentials SeekrFlow needs and confirm you have every value from provisioning before you prepare the install.

Gather everything on this page before you prepare the install. Request the credentials from Seekr early, because they can take time to arrive.

## Request credentials

Store each credential using the approach you chose in [Set up secret management](/self-managed/flow/provision/secret-management).

### From Seekr

Request these from your Seekr account team:

* **License key** – Validated at startup by the License service. Pods don't become ready without a valid key.
* **Registry credentials** – A username and user token for Seekr's registry, which you use to pull the chart and images. Tokens expire once a year. When yours expires, image pulls and upgrades fail with authentication errors until you get a new one.
* **Model configuration** – A `flowmodel.yaml` file that defines which models to run on your GPU nodes and how to size them.

### From third parties

* **Hugging Face access token** – Required for every deployment. SeekrFlow also uses it to download gated model weights, which include most Llama variants. A free Hugging Face account includes an access token. For each gated model you run, accept its license on the model's Hugging Face page, using the account that owns the token.
* **Brave Search API key** – Lets agents run web searches. Without it, agents can't search the web. Sign up for the [Brave Search API](https://brave.com/search/api/), subscribe to the Data for Search API plan, which has a free tier, and generate a key from the developer dashboard.

### Amazon Bedrock access

To use models hosted in Amazon Bedrock, make sure your cloud account can use each model before you configure it:

* **Amazon Bedrock** – Most models are available without setup. Before you use an Anthropic model, submit the one-time use-case form in the Amazon Bedrock console. In Amazon Web Services (AWS) GovCloud (US), request access to each model in the console.

## Record your values

Confirm you have every value in these tables. Each table also appears on the page where you create the resource. `sfe bootstrap` asks for most of these values when it generates your values file, and you enter the rest when you create secrets.

### Cluster

From [Provision the cluster](/self-managed/flow/provision/cluster).

| Value | Used for | Example or format |
| - | - | - |
| Cluster name | `global.cloudProvider.clusterName` | `seekrflow-prod` |
| AWS Region, AWS only | `global.cloudProvider.aws.region` | `us-east-1` |
| Kubernetes context | Your `sfe` profile | The `kubectl` context for this cluster. |
| GPU node label | `global.defaults.gpuNodeLabel` | `nvidia.com/gpu.present: "true"` |
| Whether a JobSet controller is running | `jobset.enabled` | `true` only if you need multi-node fine-tuning and the cluster has no JobSet controller. |

### Networking

From [Set up networking and cluster policies](/self-managed/flow/provision/networking).

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    | Value | Used for | Example or format |
    | - | - | - |
    | Hostname | `global.ingress.host` | `seekrflow.example.com` |
    | Ingress class | `global.ingress.className` | `"alb"` |
    | Chart-managed or externally managed ingress | `global.ingress.enabled` | `true` for chart-managed ingress. |
    | Load balancer annotations | `global.ingress.annotations` | SeekrFlow requires `target-type: ip` and HTTPS on port 443, and recommends a 300-second idle timeout. See [Load balancer annotations](/self-managed/flow/provision/networking#load-balancer-annotations). |
  </Tab>

  <Tab title="On-premises">
    | Value | Used for | Example or format |
    | - | - | - |
    | Hostname | `global.ingress.host` | `seekrflow.example.com` |
    | Ingress class | `global.ingress.className` | `"nginx"` or `"traefik"` |
    | Chart-managed or externally managed ingress | `global.ingress.enabled` | `true` for chart-managed ingress. |
  </Tab>
</Tabs>

### PostgreSQL

From [Provision PostgreSQL](/self-managed/flow/provision/postgresql).

| Value | Used for | Example or format |
| - | - | - |
| Instance hostname | `global.defaults.postgres.host`, and the `pg-creds` secret: `PG_HOST` | The endpoint of your database instance. |
| Port | `global.defaults.postgres.port` | `5432` |
| Admin account name and password | `pg-creds` secret: `PG_USER`, `PG_PASS` | The admin credentials you set when you created the instance. SeekrFlow uses them for migrations. |
| Application role password | `pg-creds` secret: `PG_APP_PASS` | The password you generated for `seekrflow_app`. |
| Keycloak role password, if you enable Keycloak | `keycloak-credentials` secret: `db-password` | The password you generated for `seekrflow_keycloak`. |

### OpenSearch

From [Provision OpenSearch](/self-managed/flow/provision/opensearch).

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    | Value | Used for | Example or format |
    | - | - | - |
    | Hostname | `global.defaults.opensearch.host` | Your domain endpoint. |
    | Port | `global.defaults.opensearch.port` | `443` for Amazon OpenSearch Service, `9200` for OpenSearch you run yourself. |
    | Scheme | `global.defaults.opensearch.scheme` | `"https://"` |
    | Whether the chart deploys OpenSearch | `opensearch.enabled` | `false`. `sfe bootstrap` sets it to `true`, which you correct in [Create the values file](/self-managed/flow/prepare/values-file). |
  </Tab>

  <Tab title="On-premises">
    | Value | Used for | Example or format |
    | - | - | - |
    | Whether the chart deploys OpenSearch | `opensearch.enabled` | `true` |
    | Admin user | `opensearch-credentials` secret: `OPENSEARCH_USER` | `admin`. OpenSearch requires this name. |
    | Admin password | `opensearch-credentials` secret: `OPENSEARCH_PASS` | The password you generated, or the one `sfe secrets create --auto-generate` creates. |
    | Scheme | `global.defaults.opensearch.scheme` | `"https://"` |
  </Tab>
</Tabs>

### Storage

From [Provision storage](/self-managed/flow/provision/storage).

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    | Value | Used for | Example or format |
    | - | - | - |
    | Bucket name | `global.fileStorePath` | `seekrflow-data`, or `seekrflow-data/prod` with a path. Use the bare bucket name, without `s3://`. |
    | Shared file storage type | `global.SharedModelCache.type` | `"efs"` |
    | File system ID | `global.SharedModelCache.efs.fileSystemId` | `fs-0123456789abcdef0` |
  </Tab>

  <Tab title="On-premises">
    | Value | Used for | Example or format |
    | - | - | - |
    | Bucket name | `global.fileStorePath` | `seekrflow-data`, or `seekrflow-data/prod` with a path. Use the bare bucket name, without a scheme such as `s3://`. |
    | Object store endpoint | `global.cloudProvider.on-prem.storageEndpoint` | `http://minio.seekrflow.svc:9000` |
    | Object store access keys | `appliance-storage-creds` secret: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | Your MinIO access key and secret key. |
    | Shared file storage type | `global.SharedModelCache.type` | `"nfs"` or `"longhorn"` |
    | NFS server and path | `global.SharedModelCache.nfs.server`, `global.SharedModelCache.nfs.path` | Your NFS server hostname or IP address, and the exported path. |
    | Existing Longhorn storage class | `global.SharedModelCache.createStorageClass`, `global.SharedModelCache.storageClassName` | `false` and `longhorn` |
  </Tab>
</Tabs>

### Cloud identity

From [Set up cloud identity](/self-managed/flow/provision/cloud-identity).

| Value | Used for | Example or format |
| - | - | - |
| Role ARN, IAM roles for service accounts only | `global.cloudProvider.identity` annotation `eks.amazonaws.com/role-arn` | `arn:aws:iam::123456789012:role/seekrflow`. For Amazon EKS Pod Identity, leave `global.cloudProvider.identity` as `{}`. Setting the role ARN switches SeekrFlow's workflow pods to IAM roles for service accounts, which fails without an OIDC provider. |

### Secret management

From [Set up secret management](/self-managed/flow/provision/secret-management).

| Value | Used for | Example or format |
| - | - | - |
| Create the secret store | `global.Secrets.store.create` | `true` |
| Secret store provider | `global.Secrets.store.provider` | On AWS, the service and Region, such as `aws: {service: SecretsManager, region: us-east-1}`. For HashiCorp Vault, the server address and authentication. |

### Credentials

From the credentials you requested in [Request credentials](#request-credentials).

| Value | Used for | Example or format |
| - | - | - |
| License key | `seekrflow-license` secret: `license_key` | A long token from your Seekr account team. |
| Registry username and token | The `seekrflow-artifacts-pull-access` image pull secret | From your Seekr account team. |
| Model configuration | Merged into your values file under `FlowModel.models` | The `flowmodel.yaml` file from your Seekr account team. |
| Hugging Face access token | `hf-token` secret: `HF_TOKEN` | Starts with `hf_`. |
| Brave Search API key | `brave-search-api-key` secret: `BRAVE_SEARCH_API_KEY` | From the Brave Search API developer dashboard. |
| External model IDs, optional | The model settings in [Configure models](/self-managed/flow/prepare/models) | An `aws-bedrock:` model ID. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.