# FedRAMP Install

This page covers installing Kloudfuse using the `kfuse-fed` Helm chart for FedRAMP environments. The FedRAMP chart uses AWS managed services (RDS, ElastiCache, MSK) instead of bundled in-cluster deployments.

Before proceeding, complete the following:

1. [Prerequisites](https://docs.kloudfuse.com/platform/4.0.2/setup/install/prequisites/)
   
   - [Helm Registry Login](https://docs.kloudfuse.com/platform/4.0.2/setup/fed/federated-install/#helm-registry)
   
   - [Namespace and Image Pull Secret](https://docs.kloudfuse.com/platform/4.0.2/setup/fed/federated-install/#namespace)
   
   - [Create custom-values.yaml](https://docs.kloudfuse.com/platform/4.0.2/setup/fed/federated-install/#values)
   
   - [Install](https://docs.kloudfuse.com/platform/4.0.2/setup/fed/federated-install/#install)

## Helm Registry Login

`token.json` is the GCP service account key file provided by Kloudfuse for accessing the Helm chart registry.

```console
cat token.json | helm registry login -u _json_key --password-stdin us-east1-docker.pkg.dev
```

## Namespace and Image Pull Secret

```console
export NAMESPACE=<your-namespace>

kubectl create namespace "$NAMESPACE"

kubectl create secret docker-registry kfuse-image-pull-credentials \
  --namespace="$NAMESPACE" \
  --docker-server='us.gcr.io' \
  --docker-username=_json_key \
  --docker-email='container-registry@mvp-demo-301906.iam.gserviceaccount.com' \
  --docker-password="$(cat token.json)"
```

## Create custom-values.yaml

Start with the FedRAMP values from [Cloud Services](https://docs.kloudfuse.com/platform/4.0.2/setup/cloud-services/overview/) and add any environment-specific overrides (TLS, ingress, observability, affinity, tolerations).

## Install

```console
helm upgrade --install kfuse \
  oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/kfuse-fed \
  --namespace="$NAMESPACE" \
  --version <chart-version> \
  -f custom-values.yaml
```