Deploy Qodo using Helm

helm registry login artifacts-self-hosted.qodo.ai \
  --username '<your-qodo-account-email>' \
  --password '<your-qodo-licence-id>'

global:
  entra:
    type: generic-oidc
    name: "Entra GCC High"
    clientId: "<Application (client) ID>"
    tenantId: ""
    issuerUrl: "https://login.microsoftonline.us/<tenant-id>/v2.0"
    existingSecret: qodo-entra-idp

NAMESPACE=qodo
kubectl create secret generic qodo-entra-idps -n "$NAMESPACE" \
  --from-literal='DYNACONF_ZITADEL_PROVISION__EXTERNAL_IDPS=[{type="entra",name="Corporate",issuer_url="https://login.microsoftonline.com/<tenant-a>/v2.0",client_id="<client-a>",client_secret="<secret-a>"},{type="generic-oidc",name="GCC High",issuer_url="https://login.microsoftonline.us/<tenant-b>/v2.0",client_id="<client-b>",client_secret="<secret-b>"}]'

global:
  entra:
    name: ""
    clientId: ""
    tenantId: ""
    externalIdpsExistingSecret: qodo-entra-idps

# Pick your namespace once and reuse it in every command on this page.
NAMESPACE=qodo
kubectl create namespace "$NAMESPACE"

# 1. Image pull credentials (issued by Qodo). The name is fixed.
#    OPTION A ONLY — not needed when installing from the Qodo registry.
kubectl create secret docker-registry qodo-pull -n "$NAMESPACE" \
  --docker-server=artif-reg-self-hosted.codium.ai \
  --docker-username='<your-qodo-account-email>' \
  --docker-password='<your-qodo-license-id>'

# 2. LLM endpoint API key.
kubectl create secret generic qodo-openai -n "$NAMESPACE" \
  --from-literal=OPENAI_API_KEY='<api-key>'

# 3. Single-tenant Entra client secret (the app registration from section 3).
#    For multiple tenants, create qodo-entra-idps as documented above instead.
#    A legacy qodo-entra-idp may remain during migration; list mode ignores it.
kubectl create secret generic qodo-entra-idp -n "$NAMESPACE" \
  --from-literal=IDP_CLIENT_SECRET='<client-secret>'

# 4. YOUR OWN DATABASE SERVER ONLY. Use that server's EXISTING admin
#    password (see step 5). Do not run this for bundled PostgreSQL: Helm
#    generates and owns qodo-db-admin when generatedSecrets.render=true.
kubectl create secret generic qodo-db-admin -n "$NAMESPACE" \
  --from-literal=POSTGRES_PASSWORD='<existing-database-admin-password>'

global:
  externalDatabase:
    host: qodo-postgres        # the in-cluster Service — leave as-is
    adminUser: postgres        # in-cluster superuser — correct here
    sslMode: disable           # the bundled server does not enable TLS
    existingSecret: qodo-db-admin
postgres:
  enabled: true                # brings the server up

global:
  externalDatabase:
    enabled: true
    host: <your-db-host>
    adminUser: <admin user>          # see the warning below
    sslMode: require                 # encrypted; the managed-server default
    existingSecret: qodo-db-admin

CREATE DATABASE rag_db OWNER qodo_admin;      -- skip if it already exists
CREATE DATABASE qodo_rules OWNER qodo_admin;  -- skip if it already exists
ALTER DATABASE rag_db OWNER TO qodo_admin;
ALTER DATABASE qodo_rules OWNER TO qodo_admin;
\c rag_db
CREATE EXTENSION IF NOT EXISTS vector;
\c qodo_rules
CREATE EXTENSION IF NOT EXISTS vector;

helm upgrade --install qodo ./qodo-onprem -n qodo \
  -f onprem-base.yaml -f my-values.yaml -f qodo-onprem/values-emptydir.yaml

Error: UPGRADE FAILED: cannot patch "qodo-rabbitmq" with kind StatefulSet:
  StatefulSet.apps "qodo-rabbitmq" is invalid: spec: Forbidden: updates to
  statefulset spec for fields other than 'replicas', 'ordinals', 'template',
  'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and
  'minReadySeconds' are forbidden

kubectl delete deploy qodo-gitway -n <namespace>

kubectl delete pvc qodo-gitway-repo-store -n <namespace>

global:
  externalRedis:
    host: <your-redis-host>

kubectl -n qodo create secret generic qodo-redis-auth \
  --from-literal=REDIS_PASSWORD='<password>'

global:
  externalRedis:
    host: <your-redis-host>
    existingSecret: qodo-redis-auth

global:
  baseDomain: qodo.example.com
  ingress:
    className: nginx
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt
  entra:
    name: Corporate SSO
    clientId: <application-client-id>
    tenantId: <directory-tenant-id>
  llm:
    openaiBaseUrl: https://llm-gateway.example.internal/v1

global:
  externalDatabase:
    enabled: true                    # without this the other keys are ignored
    host: postgres.example.internal
    adminUser: qodo_admin
    existingSecret: qodo-db-admin

helm upgrade --install qodo ./qodo-onprem \
  --namespace "$NAMESPACE" \
  -f onprem-base.yaml \
  -f my-values.yaml

helm pull oci://artifacts-self-hosted.qodo.ai/codium-stack/qodo-onprem/qodo-onprem \
  --version <chart-version> --untar

helm upgrade --install qodo ./qodo-onprem \
  --namespace "$NAMESPACE" \
  -f qodo-onprem/onprem-base.yaml \
  -f my-values.yaml

kubectl get pods -n "$NAMESPACE" -w

# All workloads ready, setup jobs Completed
kubectl get pods -n "$NAMESPACE"

# The ingress has an address
kubectl get ingress -n "$NAMESPACE"

kubectl describe pod <pod> -n <namespace> | grep -A4 'Last State'

pr-agent-litegit:
  deployments:
    resources:
      limits:
        memory: 16Gi
      requests:
        memory: 16Gi
pr-agent-agentic:
  deployments:
    resources:
      limits:
        memory: 16Gi
      requests:
        memory: 8Gi