Helm chart deploy

sureops can be deployed to any Kubernetes cluster using the sureops Helm chart. This guide covers prerequisites, chart installation, values configuration, and secrets management.

Self-hosting is available by direct arrangement with the sureops team. The Helm chart isn’t published to a public repository — contact hello@sureops.ai for image registry credentials, the chart archive, and a starter values file tailored to your cluster before starting this guide.

Prerequisites

Before installing the chart, verify you have:

Kubernetes 1.24 or later (the chart doesn’t enforce a minimum version at install time)
Helm 3.10 or later
An external PostgreSQL database — the chart doesn’t provide an in-cluster option
Image pull credentials for the sureops container registry (registry.sureops.ai)
The Helm chart archive and a starter values file, provided directly by your sureops contact
A license key, if your arrangement with sureops requires one (see the optional license-key secret below)

Get the chart

The sureops chart isn’t published to a public Helm repository. Your sureops contact sends you the chart directly as a versioned archive (for example, sureops-0.1.0.tgz) along with a starter values.yaml for your environment. Once you have the archive, you can inspect it before installing:

tar tzf sureops-0.1.0.tgz
helm show values sureops-0.1.0.tgz

Image pull secret

sureops images are hosted in a private registry. Create an image pull secret in your target namespace before installing:

kubectl create secret docker-registry sureops-registry \
  --docker-server=registry.sureops.ai \
  --docker-username=<your-registry-username> \
  --docker-password=<your-registry-password> \
  --namespace sureops

The chart expects this secret to be named sureops-registry by default (configurable via global.imagePullSecrets).

Create the sureops secret

The chart reads sensitive configuration from a Kubernetes Secret rather than values.yaml. Create it with the required keys before installing:

kubectl create secret generic sureops-secret \
  --from-literal=db-password=<postgres-password> \
  --from-literal=anthropic-api-key=<your-anthropic-api-key> \
  --from-literal=encryption-master-key=<random-32-byte-key> \
  --namespace sureops

A few keys are optional — add them only if you use the corresponding feature:

langchain-api-key — enables LangSmith tracing
oidc-client-secret — required only if you set api.env.AUTH_MODE: oidc (see Authentication below)
license-key — your sureops license key, if your arrangement requires one

This secret is named sureops-secret only when your Helm release name contains “sureops” (as in the helm install sureops ... command used throughout this guide). For any other release name, the chart expects <release-name>-sureops-secret instead. The exact name is always echoed back in the helm install/helm upgrade output, so copy it from there if you’re unsure.

Because you’re creating this secret yourself, you must also set secrets.externalManaged: true in your values file — otherwise the chart tries to manage the same Secret resource on install and the two collide. This is included in the minimal values file below. The same flag applies if you instead manage the secret through External Secrets Operator, Sealed Secrets, or Vault.

Minimal values file

Create a values.yaml for your deployment. Start with the minimum required overrides:

global:
  imageRegistry: registry.sureops.ai

secrets:
  externalManaged: true

api:
  env:
    AUTH_MODE: supabase

postgresql:
  external:
    host: postgres.your-domain.com
    port: 5432
    database: sureops
    username: sureops

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: sureops.your-domain.com
      paths:
        - path: /api
          pathType: Prefix
          service: api
        - path: /
          pathType: Prefix
          service: frontend
  tls:
    - secretName: sureops-tls
      hosts:
        - sureops.your-domain.com

For production deployments, also set resource limits and replica counts appropriate for your cluster — see the Values reference below.

Install the chart

helm install sureops ./sureops-0.1.0.tgz \
  --namespace sureops \
  --create-namespace \
  --values values.yaml

Replace sureops-0.1.0.tgz with the archive filename your sureops contact provided. Verify all pods come up:

kubectl get pods -n sureops

Expected pods: sureops-api-*, sureops-agent-worker-*, and — unless you set frontend.enabled: false — sureops-frontend-*.

Upgrade

helm upgrade sureops ./sureops-0.1.0.tgz \
  --namespace sureops \
  --values values.yaml

To move to a newer chart version, ask your sureops contact for the updated archive and point helm upgrade at it. The chart version is set in the archive’s own Chart.yaml (current: 0.1.0) — there’s no separate --version flag to reach for, since the chart isn’t resolved from a repository.

Values reference

API server

Value	Default	Description
`api.replicaCount`	`2`	Number of API server replicas
`api.image.tag`	`0.1.0`	Image tag to deploy
`api.resources.requests.cpu`	`250m`	CPU request per replica
`api.resources.requests.memory`	`512Mi`	Memory request per replica
`api.resources.limits.cpu`	`1000m`	CPU limit per replica
`api.resources.limits.memory`	`2Gi`	Memory limit per replica
`api.env.ENVIRONMENT`	`production`	Runtime environment name
`api.env.AUTH_MODE`	`oidc` (chart default)	Authentication mode — `supabase` or `oidc`. See Authentication
`api.env.AGENT_DEFAULT_MODEL`	`claude-sonnet-4-6`	Default LLM model used for agent runs
`api.env.LANGCHAIN_PROJECT`	`sureops-production`	LangSmith project name used for tracing
`api.env.CORS_ORIGINS`	unset	Allowed CORS origins — set this if you host the frontend separately from the API

Authentication

The chart ships with api.env.AUTH_MODE: oidc as its packaged default, but most self-hosted installs find supabase simpler to start with — it’s the same default the sureops backend uses everywhere else — unless you already have an OIDC identity provider you want to integrate. The minimal values file above sets AUTH_MODE: supabase for that reason. If you do use oidc, you additionally need to set:

api.env.OIDC_ISSUER — your identity provider’s issuer URL
api.env.OIDC_CLIENT_ID — the OIDC client ID registered with your provider
the oidc-client-secret key in the sureops secret — the corresponding client secret

Agent worker

Value	Default	Description
`agentWorker.replicaCount`	`2`	Number of agent worker replicas
`agentWorker.resources.requests.cpu`	`500m`	CPU request per replica
`agentWorker.resources.requests.memory`	`1Gi`	Memory request per replica
`agentWorker.resources.limits.cpu`	`2000m`	CPU limit per replica
`agentWorker.resources.limits.memory`	`4Gi`	Memory limit per replica

PostgreSQL

The chart does not deploy or manage a PostgreSQL instance — you bring your own external database, and the chart connects to it using:

Value	Default	Description
`postgresql.external.host`	`postgres.example.com`	External database host — always override this
`postgresql.external.port`	`5432`	External database port
`postgresql.external.database`	`sureops`	Database name
`postgresql.external.username`	`sureops`	Database user

The database password is read from the db-password key in the sureops secret, not from values.yaml.

values.yaml also ships a postgresql.enabled flag with an in-cluster-looking image/resources/persistence block underneath it. No template in the chart actually deploys PostgreSQL — that block is vestigial. Leave postgresql.enabled: false and configure postgresql.external.* as shown above; setting it to true will not create a database and will leave DATABASE_URL pointing at a host that doesn’t exist.

Frontend

Value	Default	Description
`frontend.enabled`	`true`	Deploy the sureops frontend in your cluster
`frontend.replicaCount`	`1`	Number of frontend replicas

The frontend pod is deployed by default. Set frontend.enabled: false if you serve the frontend from a CDN or external host instead.

Ingress

Value	Default	Description
`ingress.enabled`	`true`	Enable ingress resource creation
`ingress.className`	`nginx`	Ingress class name
`ingress.annotations`	`cert-manager.io/cluster-issuer: letsencrypt-prod`, `nginx.ingress.kubernetes.io/proxy-body-size: "10m"`, `nginx.ingress.kubernetes.io/proxy-read-timeout: "60"`	Annotations applied to the Ingress resource

The default cert-manager.io/cluster-issuer: letsencrypt-prod annotation assumes a ClusterIssuer named letsencrypt-prod already exists on your cluster. If it doesn’t, either create one or override ingress.annotations to match your own certificate setup.

Secrets

Value	Default	Description
`secrets.externalManaged`	`false`	Set to `true` whenever you manage the sureops secret yourself — including the plain `kubectl create secret` flow in this guide — so the chart doesn’t also try to manage it

Production checklist

Before running in production:

Size your external PostgreSQL for production

The chart does not provision or manage PostgreSQL — plan your own high availability and backup strategy for the external database it connects to.

Configure TLS

Set up TLS termination via your ingress controller and cert-manager, or a load balancer in front of the cluster. sureops must be served over HTTPS.

Tune resource limits

Adjust api.resources and agentWorker.resources based on your expected incident volume. Agent workers are CPU and memory intensive during active incident resolution.

Author your own PodDisruptionBudgets

The chart does not create PodDisruptionBudgets. For high-availability deployments, author your own PDB manifests for the api and agent-worker Deployments so at least one replica stays available during rolling updates.

Set up log aggregation

All sureops components log to stdout in JSON format. Route logs to your preferred aggregation stack (Loki, OpenSearch, or any log sink that accepts JSON over stdout).

Configure backups for PostgreSQL

Ensure your external PostgreSQL instance has point-in-time recovery or regular backups configured. sureops stores all incident data, agent checkpoints, and audit logs in the database.

Uninstall

helm uninstall sureops --namespace sureops

This removes all Kubernetes resources created by the chart but does not delete the sureops namespace or the sureops secret (named sureops-secret, or <release-name>-sureops-secret if you used a different release name). Delete those manually if needed. Your external PostgreSQL database and data are not affected by uninstalling the chart.

Give feedback — report issues with the chart or request new configuration options

Getting Started

Onboarding & Setup

Using sureops

Operating Modes & Trust

Integrations

Your Rules (.sureops)

AI Agents & Models

Problem Management

Administration

Self-Hosting

Reference

Helm chart deploy

Prerequisites

Get the chart

Image pull secret

Create the sureops secret

Minimal values file

Install the chart

Upgrade

Values reference

API server

Authentication

Agent worker

PostgreSQL

Frontend

Ingress

Secrets

Production checklist

Uninstall

​Prerequisites

​Get the chart

​Image pull secret

​Create the sureops secret

​Minimal values file

​Install the chart

​Upgrade

​Values reference

​API server

​Authentication

​Agent worker

​PostgreSQL

​Frontend

​Ingress

​Secrets

​Production checklist

​Uninstall

​Related

Prerequisites

Get the chart

Image pull secret

Create the sureops secret

Minimal values file

Install the chart

Upgrade

Values reference

API server

Authentication

Agent worker

PostgreSQL

Frontend

Ingress

Secrets

Production checklist

Uninstall

Related