Helm chart deploy

sureops can be deployed to any Kubernetes cluster using the official Helm chart. This guide covers prerequisites, chart installation, values configuration, and secrets management.

Self-hosting is available on sureops Enterprise. Contact sales@sureops.ai for licensing details and image registry credentials before starting this guide.

Prerequisites

Before installing the chart, verify you have:

Kubernetes 1.25 or later
Helm 3.10 or later
A PostgreSQL 14+ database (external recommended for production; in-cluster available for development)
Image pull credentials for the sureops container registry (registry.sureops.ai)
A valid sureops Enterprise license key

Add the Helm repository

helm repo add sureops https://sureops-public.github.io/sureops
helm repo update

Verify the chart is available:

helm search repo sureops

Image pull secret

sureops images are hosted in a private registry. Create an image pull secret in your target namespace before installing:

kubectl create secret docker-registry sureops-registry \
  --docker-server=registry.sureops.ai \
  --docker-username=<your-registry-username> \
  --docker-password=<your-registry-password> \
  --namespace sureops

The chart expects this secret to be named sureops-registry by default (configurable via global.imagePullSecrets).

Create the sureops secret

The chart expects a Kubernetes secret named sureops-secret with the following keys:

kubectl create secret generic sureops-secret \
  --from-literal=db-password=<postgres-password> \
  --from-literal=secret-key=<random-32-char-string> \
  --from-literal=license-key=<your-enterprise-license-key> \
  --from-literal=llm-api-key=<your-llm-provider-api-key> \
  --namespace sureops

If you manage secrets out-of-band (External Secrets Operator, Sealed Secrets, Vault), set secrets.externalManaged: true in your values file and create the sureops-secret through your preferred mechanism.

Minimal values file

Create a values.yaml for your deployment. Start with the minimum required overrides:

global:
  imageRegistry: registry.sureops.ai

postgresql:
  enabled: false
  external:
    host: postgres.your-domain.com
    port: 5432
    database: sureops
    username: sureops

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: sureops.your-domain.com
      paths:
        - path: /api
          pathType: Prefix
          service: api
        - path: /
          pathType: Prefix
          service: frontend
  tls:
    - secretName: sureops-tls
      hosts:
        - sureops.your-domain.com

For production deployments, also set resource limits and replica counts appropriate for your cluster — see the Values reference below.

Install the chart

helm install sureops sureops/sureops \
  --namespace sureops \
  --create-namespace \
  --values values.yaml

Verify all pods come up:

kubectl get pods -n sureops

Expected pods: sureops-api-*, sureops-agent-worker-*, and optionally sureops-frontend-*.

Upgrade

helm upgrade sureops sureops/sureops \
  --namespace sureops \
  --values values.yaml

To upgrade to a specific chart version:

helm upgrade sureops sureops/sureops \
  --version 1.2.0 \
  --namespace sureops \
  --values values.yaml

Values reference

API server

Value	Default	Description
`api.replicaCount`	`2`	Number of API server replicas
`api.image.tag`	`0.1.0`	Image tag to deploy
`api.resources.requests.cpu`	`250m`	CPU request per replica
`api.resources.requests.memory`	`512Mi`	Memory request per replica
`api.resources.limits.cpu`	`1000m`	CPU limit per replica
`api.resources.limits.memory`	`2Gi`	Memory limit per replica
`api.env.ENVIRONMENT`	`production`	Runtime environment name
`api.env.AUTH_MODE`	`oidc`	Authentication mode (`oidc` or `supabase`)

Agent worker

Value	Default	Description
`agentWorker.replicaCount`	`2`	Number of agent worker replicas
`agentWorker.resources.requests.cpu`	`500m`	CPU request per replica
`agentWorker.resources.requests.memory`	`1Gi`	Memory request per replica
`agentWorker.resources.limits.cpu`	`2000m`	CPU limit per replica
`agentWorker.resources.limits.memory`	`4Gi`	Memory limit per replica

PostgreSQL

Value	Default	Description
`postgresql.enabled`	`false`	Deploy an in-cluster PostgreSQL instance
`postgresql.external.host`	—	External database host
`postgresql.external.database`	`sureops`	Database name
`postgresql.external.username`	`sureops`	Database user
`postgresql.persistence.size`	`20Gi`	PVC size (in-cluster only)

Frontend

Value	Default	Description
`frontend.enabled`	`true`	Deploy the sureops frontend from the cluster
`frontend.replicaCount`	`1`	Number of frontend replicas

Set frontend.enabled: false if you serve the frontend from a CDN or external host.

Ingress

Value	Default	Description
`ingress.enabled`	`true`	Enable ingress resource creation
`ingress.className`	`nginx`	Ingress class name
`ingress.annotations`	—	Annotations to apply (e.g., cert-manager)

Secrets

Value	Default	Description
`secrets.externalManaged`	`false`	Set to `true` if you manage the `sureops-secret` out-of-band

Production checklist

Before running in production:

Use an external PostgreSQL database

Set postgresql.enabled: false and configure postgresql.external.*. An in-cluster database is not suitable for production — it has no HA and no managed backup.

Configure TLS

Set up TLS termination via your ingress controller and cert-manager, or a load balancer in front of the cluster. sureops must be served over HTTPS.

Tune resource limits

Adjust api.resources and agentWorker.resources based on your expected incident volume. Agent workers are CPU and memory intensive during active incident resolution.

Enable pod disruption budgets

For high-availability deployments, configure PodDisruptionBudgets to ensure at least one replica remains available during rolling updates.

Set up log aggregation

All sureops components log to stdout in JSON format. Route logs to your preferred aggregation stack (Loki, OpenSearch, or any log sink that accepts JSON over stdout).

Configure backups for PostgreSQL

Ensure your external PostgreSQL instance has point-in-time recovery or regular backups configured. sureops stores all incident data, agent checkpoints, and audit logs in the database.

Uninstall

helm uninstall sureops --namespace sureops

This removes all Kubernetes resources created by the chart but does not delete the sureops namespace or the sureops-secret. Delete those manually if needed. Your external PostgreSQL database and data are not affected by uninstalling the chart.

Give feedback — report issues with the chart or request new configuration options

Getting Started

Onboarding & Setup

Using sureops

Operating Modes & Trust

Integrations

Your Rules (.sureops)

AI Agents & Models

Problem Management

Administration

Self-Hosting

Reference

Helm chart deploy

Prerequisites

Add the Helm repository

Image pull secret

Create the sureops secret

Minimal values file

Install the chart

Upgrade

Values reference

API server

Agent worker

PostgreSQL

Frontend

Ingress

Secrets

Production checklist

Uninstall

​Prerequisites

​Add the Helm repository

​Image pull secret

​Create the sureops secret

​Minimal values file

​Install the chart

​Upgrade

​Values reference

​API server

​Agent worker

​PostgreSQL

​Frontend

​Ingress

​Secrets

​Production checklist

​Uninstall

​Related

Prerequisites

Add the Helm repository

Image pull secret

Create the sureops secret

Minimal values file

Install the chart

Upgrade

Values reference

API server

Agent worker

PostgreSQL

Frontend

Ingress

Secrets

Production checklist

Uninstall

Related