> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm chart deploy

> Self-host sureops on your own Kubernetes cluster using the official Helm chart

sureops can be deployed to any Kubernetes cluster using the official Helm chart. This guide covers prerequisites, chart installation, values configuration, and secrets management.

<Note>
  Self-hosting is available on sureops Enterprise. Contact [sales@sureops.ai](mailto:sales@sureops.ai) for licensing details and image registry credentials before starting this guide.
</Note>

***

## Prerequisites

Before installing the chart, verify you have:

* Kubernetes 1.25 or later
* Helm 3.10 or later
* A PostgreSQL 14+ database (external recommended for production; in-cluster available for development)
* Image pull credentials for the sureops container registry (`registry.sureops.ai`)
* A valid sureops Enterprise license key

***

## Add the Helm repository

```bash theme={null}
helm repo add sureops https://sureops-public.github.io/sureops
helm repo update
```

Verify the chart is available:

```bash theme={null}
helm search repo sureops
```

***

## Image pull secret

sureops images are hosted in a private registry. Create an image pull secret in your target namespace before installing:

```bash theme={null}
kubectl create secret docker-registry sureops-registry \
  --docker-server=registry.sureops.ai \
  --docker-username=<your-registry-username> \
  --docker-password=<your-registry-password> \
  --namespace sureops
```

The chart expects this secret to be named `sureops-registry` by default (configurable via `global.imagePullSecrets`).

***

## Create the sureops secret

The chart expects a Kubernetes secret named `sureops-secret` with the following keys:

```bash theme={null}
kubectl create secret generic sureops-secret \
  --from-literal=db-password=<postgres-password> \
  --from-literal=secret-key=<random-32-char-string> \
  --from-literal=license-key=<your-enterprise-license-key> \
  --from-literal=llm-api-key=<your-llm-provider-api-key> \
  --namespace sureops
```

If you manage secrets out-of-band (External Secrets Operator, Sealed Secrets, Vault), set `secrets.externalManaged: true` in your values file and create the `sureops-secret` through your preferred mechanism.

***

## Minimal values file

Create a `values.yaml` for your deployment. Start with the minimum required overrides:

```yaml theme={null}
global:
  imageRegistry: registry.sureops.ai

postgresql:
  enabled: false
  external:
    host: postgres.your-domain.com
    port: 5432
    database: sureops
    username: sureops

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: sureops.your-domain.com
      paths:
        - path: /api
          pathType: Prefix
          service: api
        - path: /
          pathType: Prefix
          service: frontend
  tls:
    - secretName: sureops-tls
      hosts:
        - sureops.your-domain.com
```

For production deployments, also set resource limits and replica counts appropriate for your cluster — see the [Values reference](#values-reference) below.

***

## Install the chart

```bash theme={null}
helm install sureops sureops/sureops \
  --namespace sureops \
  --create-namespace \
  --values values.yaml
```

Verify all pods come up:

```bash theme={null}
kubectl get pods -n sureops
```

Expected pods: `sureops-api-*`, `sureops-agent-worker-*`, and optionally `sureops-frontend-*`.

***

## Upgrade

```bash theme={null}
helm upgrade sureops sureops/sureops \
  --namespace sureops \
  --values values.yaml
```

To upgrade to a specific chart version:

```bash theme={null}
helm upgrade sureops sureops/sureops \
  --version 1.2.0 \
  --namespace sureops \
  --values values.yaml
```

***

## Values reference

### API server

| Value                           | Default      | Description                                |
| ------------------------------- | ------------ | ------------------------------------------ |
| `api.replicaCount`              | `2`          | Number of API server replicas              |
| `api.image.tag`                 | `0.1.0`      | Image tag to deploy                        |
| `api.resources.requests.cpu`    | `250m`       | CPU request per replica                    |
| `api.resources.requests.memory` | `512Mi`      | Memory request per replica                 |
| `api.resources.limits.cpu`      | `1000m`      | CPU limit per replica                      |
| `api.resources.limits.memory`   | `2Gi`        | Memory limit per replica                   |
| `api.env.ENVIRONMENT`           | `production` | Runtime environment name                   |
| `api.env.AUTH_MODE`             | `oidc`       | Authentication mode (`oidc` or `supabase`) |

### Agent worker

| Value                                   | Default | Description                     |
| --------------------------------------- | ------- | ------------------------------- |
| `agentWorker.replicaCount`              | `2`     | Number of agent worker replicas |
| `agentWorker.resources.requests.cpu`    | `500m`  | CPU request per replica         |
| `agentWorker.resources.requests.memory` | `1Gi`   | Memory request per replica      |
| `agentWorker.resources.limits.cpu`      | `2000m` | CPU limit per replica           |
| `agentWorker.resources.limits.memory`   | `4Gi`   | Memory limit per replica        |

### PostgreSQL

| Value                          | Default   | Description                              |
| ------------------------------ | --------- | ---------------------------------------- |
| `postgresql.enabled`           | `false`   | Deploy an in-cluster PostgreSQL instance |
| `postgresql.external.host`     | —         | External database host                   |
| `postgresql.external.database` | `sureops` | Database name                            |
| `postgresql.external.username` | `sureops` | Database user                            |
| `postgresql.persistence.size`  | `20Gi`    | PVC size (in-cluster only)               |

### Frontend

| Value                   | Default | Description                                  |
| ----------------------- | ------- | -------------------------------------------- |
| `frontend.enabled`      | `true`  | Deploy the sureops frontend from the cluster |
| `frontend.replicaCount` | `1`     | Number of frontend replicas                  |

Set `frontend.enabled: false` if you serve the frontend from a CDN or external host.

### Ingress

| Value                 | Default | Description                               |
| --------------------- | ------- | ----------------------------------------- |
| `ingress.enabled`     | `true`  | Enable ingress resource creation          |
| `ingress.className`   | `nginx` | Ingress class name                        |
| `ingress.annotations` | —       | Annotations to apply (e.g., cert-manager) |

### Secrets

| Value                     | Default | Description                                                  |
| ------------------------- | ------- | ------------------------------------------------------------ |
| `secrets.externalManaged` | `false` | Set to `true` if you manage the `sureops-secret` out-of-band |

***

## Production checklist

Before running in production:

<Steps>
  <Step title="Use an external PostgreSQL database">
    Set `postgresql.enabled: false` and configure `postgresql.external.*`. An in-cluster database is not suitable for production — it has no HA and no managed backup.
  </Step>

  <Step title="Configure TLS">
    Set up TLS termination via your ingress controller and cert-manager, or a load balancer in front of the cluster. sureops must be served over HTTPS.
  </Step>

  <Step title="Tune resource limits">
    Adjust `api.resources` and `agentWorker.resources` based on your expected incident volume. Agent workers are CPU and memory intensive during active incident resolution.
  </Step>

  <Step title="Enable pod disruption budgets">
    For high-availability deployments, configure PodDisruptionBudgets to ensure at least one replica remains available during rolling updates.
  </Step>

  <Step title="Set up log aggregation">
    All sureops components log to stdout in JSON format. Route logs to your preferred aggregation stack (Loki, OpenSearch, or any log sink that accepts JSON over stdout).
  </Step>

  <Step title="Configure backups for PostgreSQL">
    Ensure your external PostgreSQL instance has point-in-time recovery or regular backups configured. sureops stores all incident data, agent checkpoints, and audit logs in the database.
  </Step>
</Steps>

***

## Uninstall

```bash theme={null}
helm uninstall sureops --namespace sureops
```

<Warning>
  This removes all Kubernetes resources created by the chart but does not delete the `sureops` namespace or the `sureops-secret`. Delete those manually if needed. Your external PostgreSQL database and data are not affected by uninstalling the chart.
</Warning>

***

## Related

* [Give feedback](/next/reference/give-feedback) — report issues with the chart or request new configuration options