1. Install the runtime

   sudo dnf install -y python3.12 python3.12-pip git
   sudo useradd --system --home /opt/cloudpilot --shell /sbin/nologin cloudpilot
   sudo mkdir -p /opt/cloudpilot /var/lib/cloudpilot
   sudo chown -R cloudpilot:cloudpilot /opt/cloudpilot /var/lib/cloudpilot

2. Install CloudPilot

   sudo -u cloudpilot tar -xzf cloudpilot-0.1.0.tar.gz -C /opt/cloudpilot
   cd /opt/cloudpilot
   sudo -u cloudpilot python3.12 -m venv .venv
   sudo -u cloudpilot .venv/bin/pip install -r requirements.txt

   Install kubectl too if you want Kubernetes cost allocation; CloudPilot shells out to it and inherits its kubeconfig.

3. Write the environment file

   sudo install -m 600 -o cloudpilot -g cloudpilot /dev/null /etc/cloudpilot.env
   sudo tee /etc/cloudpilot.env >/dev/null <<'EOF'
   DEMO_MODE=false
   DB_PATH=/var/lib/cloudpilot/cloudpilot.db
   CLOUDPILOT_API_KEY=replace-me
   CLOUDPILOT_ACCOUNTS=[{"id":"111122223333","name":"prod","regions":["ap-south-1"]}]
   LICENSE_SERVER_URL=https://license.zerolatch.in
   LICENSE_PUBLIC_KEY=replace-me
   LICENSE_KEY=ZLCP-XXXXX-XXXXX-XXXXX-XXXXX
   DRY_RUN=true
   EOF

4. Create the unit

   sudo tee /etc/systemd/system/cloudpilot.service >/dev/null <<'EOF'
   [Unit]
   Description=ZeroLatch CloudPilot
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   Type=exec
   User=cloudpilot
   Group=cloudpilot
   WorkingDirectory=/opt/cloudpilot
   EnvironmentFile=/etc/cloudpilot.env
   ExecStart=/opt/cloudpilot/.venv/bin/uvicorn main:app \
     --host 127.0.0.1 --port 8080 --workers 1
   Restart=on-failure
   RestartSec=5
   
   # Hardening: it needs its database directory and nothing else.
   NoNewPrivileges=true
   PrivateTmp=true
   ProtectSystem=strict
   ProtectHome=true
   ReadWritePaths=/var/lib/cloudpilot
   ProtectKernelTunables=true
   ProtectControlGroups=true
   RestrictSUIDSGID=true
   
   [Install]
   WantedBy=multi-user.target
   EOF
   
   sudo systemctl daemon-reload
   sudo systemctl enable --now cloudpilot
   sudo systemctl status cloudpilot

5. Check it

   curl -s localhost:8080/health | python3 -m json.tool
   journalctl -u cloudpilot -f

1. Give it an AWS identity (IRSA)

   So the pod can read Cost Explorer and your inventory without static credentials.

   eksctl create iamserviceaccount \
     --cluster prod-ap-south-1 \
     --namespace cloudpilot \
     --name cloudpilot \
     --attach-policy-arn arn:aws:iam::111122223333:policy/CloudPilotReadOnly \
     --approve

2. Create the secret

   kubectl create namespace cloudpilot
   
   kubectl -n cloudpilot create secret generic cloudpilot \
     --from-literal=api-key="$(openssl rand -hex 32)" \
     --from-literal=license-key="ZLCP-XXXXX-XXXXX-XXXXX-XXXXX" \
     --from-literal=license-public-key="<from /api/license/pubkey>"

3. Install the chart

   helm upgrade --install cloudpilot ./deploy/helm/cloudpilot \
     --namespace cloudpilot \
     --set image.tag=0.1.0 \
     --set serviceAccount.name=cloudpilot \
     --set config.demoMode=false \
     --set config.dryRun=true \
     --set-json 'config.accounts=[{"id":"111122223333","name":"prod","regions":["ap-south-1"]}]' \
     --set persistence.size=4Gi

4. Reach the dashboard

   kubectl -n cloudpilot port-forward svc/cloudpilot 8080:8080
   # or expose it through your ingress:
   #   --set ingress.enabled=true \
   #   --set ingress.host=cloudpilot.internal.example.com

5. In-cluster cost allocation

   The chart's ServiceAccount already carries the read ClusterRole, so CloudPilot reads nodes, pods and metrics with no kubeconfig. Install metrics-server if you have not — without it, allocation falls back to requests only and overprovisioning cannot be detected.

   kubectl top nodes   # must work before allocation is meaningful

1. Create your workspace

   Sign up with a work email. You become the administrator for your organisation and can invite colleagues afterwards.

2. Create the cross-account role

   In the AWS account you want to watch, create a role that trusts the ZeroLatch account and carries the read-only policy. The external ID is shown in your dashboard and is unique to you — it stops anyone else's workspace naming your role.

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Principal": { "AWS": "arn:aws:iam::ZEROLATCH_ACCOUNT_ID:role/CloudPilotCloud" },
       "Action": "sts:AssumeRole",
       "Condition": {
         "StringEquals": { "sts:ExternalId": "<the external ID from your dashboard>" }
       }
     }]
   }

   Attach CloudPilotReadOnly and nothing else to start. EKS clusters are discovered through this same role — Kubernetes is not a separate connection.

3. Paste the role ARN

   Add the account in Settings → AWS accounts. The first scan runs straight away; findings appear within a few minutes.

4. Invite your team

   Under Users, add colleagues as read or write and grant each of them the AWS accounts they should see. A new member starts with no accounts until you grant them.

5. Enable remediation when you are ready

   Add the remediation policy to the same role and turn dry run off. Until you do, CloudPilot can only report — it has no permission to change anything, whatever anyone clicks.

How the two differ

Two policies, deliberately separate

Attach the first one and CloudPilot physically cannot change anything. Add the second only when you set DRY_RUN=false.

Cross-account access

For an AWS Organization, create CloudPilotRole in each member account trusting the account CloudPilot runs in, with an ExternalId you keep secret:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::HUB_ACCOUNT_ID:role/CloudPilotHubRole" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "your-secret-string" } }
  }]
}

Kubernetes RBAC

Read access for allocation; the write verbs only if you want CloudPilot to patch workloads.

rules:
  - apiGroups: [""]
    resources: ["nodes", "pods", "namespaces", "events"]
    verbs: ["get", "list"]
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
    verbs: ["get", "list"]
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list"]