Kubernetes(헬름 차트)

# 1. Create the required secret
kubectl create secret generic myrm-secrets \
  --from-literal=JWT_SECRET=$(openssl rand -hex 32) \
  --from-literal=MYRM_CP_ADMIN_API_KEY=$(openssl rand -hex 32)

# 2. Install the chart
helm install myrm deploy/helm/myrm-platform/ -f my-values.yaml

# 3. Access the frontend
kubectl port-forward svc/myrm-frontend 3000:3000
# Open http://localhost:3000

┌─────────────────────────────────────────────┐
│                  Ingress                     │
│  frontend.host → Frontend Service (3000)     │
│  api.host      → CP Service (8003)           │
└──────────────┬────────────┬─────────────────┘
               │            │
     ┌─────────▼──┐  ┌──────▼──────────┐
     │  Frontend   │  │  Control Plane   │
     │ (Next.js)   │  │  (FastAPI)       │
     │  Deployment │  │  Deployment      │
     └─────────────┘  │  + PVC (/data)   │
                      │  + ServiceAccount │
                      └──────┬───────────┘
                             │ K8s API
                    ┌────────▼────────┐
                    │  Sandbox Pods    │
                    │  (per-user,      │
                    │   dynamic)       │
                    └─────────────────┘

images:
  controlPlane:
    repository: ghcr.io/myrmagent/myrm-control-plane
    tag: ""          # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  frontend:
    repository: ghcr.io/myrmagent/myrm-frontend
    tag: ""
    pullPolicy: IfNotPresent

global:
  imagePullSecrets: []
  #   - name: my-registry-secret

existingSecret: myrm-secrets

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  frontend:
    host: myrm.example.com
  api:
    host: api.myrm.example.com
  tls:
    - hosts: [myrm.example.com, api.myrm.example.com]
      secretName: myrm-tls

controlPlane:
  persistence:
    enabled: true
    size: 5Gi
    storageClass: ""    # uses cluster default
    accessModes:
      - ReadWriteOnce

rbac:
  create: true
  serviceAccount:
    create: true
    name: ""
    annotations: {}    # e.g. eks.amazonaws.com/role-arn

controlPlane:
  replicas: 3
  config:
    edition: enterprise
    runtime: docker
  persistence:
    enabled: true
    size: 50Gi
    storageClass: gp3

frontend:
  replicas: 2

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  frontend:
    host: myrm.mycompany.com
  api:
    host: api.myrm.mycompany.com
  tls:
    - hosts: [myrm.mycompany.com, api.myrm.mycompany.com]
      secretName: myrm-tls

rbac:
  create: true

networkPolicy:
  enabled: true

autoscaling:
  enabled: true
  controlPlane:
    minReplicas: 2
    maxReplicas: 10
    targetCPUUtilizationPercentage: 70

podDisruptionBudget:
  enabled: true
  controlPlane:
    minAvailable: 1

monitoring:
  prometheusRule:
    enabled: true
    severity: critical

helm upgrade myrm deploy/helm/myrm-platform/ -f my-values.yaml

terminationGracePeriodSeconds: 150   # 120s drain + 30s buffer

helm uninstall myrm
# PVCs are retained by default — delete manually if needed:
kubectl delete pvc myrm-control-plane-data