# Authentication

{% hint style="danger" %}
Your credentials provide access to proprietary software. Never share your credentials or commit them to public repositories.
{% endhint %}

## Overview

Our system is distributed as a Helm chart and Docker images stored in our private Artifactory repository. You need valid credentials to access these resources during the installation process.

{% tabs %}
{% tab title="Authentication Methods" %}
We support two authentication methods:

1. **Username and Password**: Basic authentication with your provided credentials
2. **API Token**: More secure method using generated tokens with configurable permissions and expiration

For production environments, we **strongly recommend** using API tokens.
{% endtab %}

{% tab title="Credential Security" %}
Follow these best practices for credential security:

* Use environment variables instead of hardcoding credentials
* Implement secrets management tools like HashiCorp Vault or Kubernetes Secrets
* Rotate credentials regularly (at least every 90 days)
* Use separate credentials for development and production environments
  {% endtab %}
  {% endtabs %}

## Requesting Access Credentials

{% hint style="info" %}
New customers should have received initial credentials from our sales team. If you haven't received them, please contact <sales@company.com>.
{% endhint %}

For additional credentials or to replace lost ones:

1. Log in to our [Customer Portal](https://portal.company.com)
2. Navigate to **Account → Access Management**
3. Click **Request New Credentials**
4. Select the appropriate access level and provide justification
5. Submit the request

Requests are typically processed within 1 business day.

## Authentication with Helm

### Using Username and Password

{% tabs %}
{% tab title="Command Line" %}
You can provide your credentials directly in the Helm command:

```bash
helm repo add maisa-repo https://artifactory.company.com/artifactory/helm-repo \
  --username YOUR_USERNAME \
  --password YOUR_PASSWORD
```

{% hint style="warning" %}
This method saves your credentials in plain text in your shell history. For better security, use environment variables or the credentials file method.
{% endhint %}
{% endtab %}

{% tab title="Environment Variables" %}
Set your credentials as environment variables:

```bash
export HELM_REPO_USERNAME=YOUR_USERNAME
export HELM_REPO_PASSWORD=YOUR_PASSWORD

helm repo add maisa-repo https://artifactory.company.com/artifactory/helm-repo
```

{% endtab %}

{% tab title="Credentials File" %}
Create a credentials file:

1. Create a file at `~/.helm/credentials.yaml` with the following content:

```yaml
artifactory.company.com:
  username: YOUR_USERNAME
  password: YOUR_PASSWORD
```

2. Secure the file:

```bash
chmod 600 ~/.helm/credentials.yaml
```

3. Add the repository without explicitly providing credentials:

```bash
helm repo add maisa-repo https://artifactory.company.com/artifactory/helm-repo
```

Helm will automatically use the credentials from the file.
{% endtab %}
{% endtabs %}

### Using API Tokens

API tokens are more secure than username and password authentication.

Use the token in place of a password:

```bash
helm repo add maisa-repo https://artifactory.company.com/artifactory/helm-repo \
  --username YOUR_USERNAME \
  --password YOUR_API_TOKEN
```

## Authentication with Docker

The Helm chart needs to pull Docker images from our private registry. You need to configure Docker to authenticate with our registry.

{% tabs %}
{% tab title="Docker Login" %}
Log in to our Docker registry:

```bash
docker login artifactory.company.com \
  --username YOUR_USERNAME \
  --password YOUR_PASSWORD
```

This command creates or updates the file `~/.docker/config.json` with your credentials.
{% endtab %}

{% tab title="Kubernetes Secret" %}
For Kubernetes to pull images from our private registry, create a secret:

```bash
kubectl create secret docker-registry maisa-registry-creds \
  --docker-server=artifactory.company.com \
  --docker-username=YOUR_USERNAME \
  --docker-password=YOUR_PASSWORD \
  --docker-email=YOUR_EMAIL
```

Then reference this secret in your values.yaml:

```yaml
imagePullSecrets:
  - name: maisa-registry-creds
```

{% endtab %}

{% tab title="Helm Values" %}
Alternatively, you can provide the credentials directly in your values.yaml:

```yaml
imageCredentials:
  registry: artifactory.company.com
  username: YOUR_USERNAME
  password: YOUR_PASSWORD
  email: YOUR_EMAIL
```

The Helm chart will create the necessary pull secret automatically.

{% hint style="warning" %}
This method stores your credentials in the values.yaml file. Ensure this file is properly secured and not committed to version control.
{% endhint %}
{% endtab %}
{% endtabs %}

## Authentication Troubleshooting

## Automatic Authentication Renewal

For continuous integration/continuous deployment (CI/CD) environments, we recommend setting up automatic token renewal.

{% tabs %}
{% tab title="API-Based Renewal" %}
Use our REST API to automatically generate new tokens before the current one expires:

```bash
curl -X POST https://portal.company.com/api/v1/tokens \
  -H "Authorization: Bearer CURRENT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Auto-renewed token",
    "scopes": ["read:helm-charts", "read:docker-images"],
    "expiration_days": 90
  }'
```

{% endtab %}

{% tab title="Using HashiCorp Vault" %}
If you're using HashiCorp Vault, you can leverage the [Artifactory Secrets Engine](https://www.vaultproject.io/docs/secrets/artifactory) to automatically manage and rotate credentials.

Example Vault configuration:

```hcl
path "artifactory/config" {
  capabilities = ["create", "update"]
}

path "artifactory/roles/*" {
  capabilities = ["create", "update", "read", "delete"]
}

path "artifactory/creds/*" {
  capabilities = ["read"]
}
```

{% endtab %}
{% endtabs %}

## Next Steps

Now that you have set up authentication, you can proceed with:

* [Installing the Helm chart](https://docs.maisa.ai/1.2.0/getting-started#step-3-install-the-chart)
* [Configuring the system](https://docs.maisa.ai/1.2.0/helm-installation/configuration-reference) according to your requirements
