Skip to main content

​
Overview

The official myrm-platform Helm Chart deploys the control plane + frontend as a dual-component release on any Kubernetes cluster. Sandbox instances (one per user) are dynamically created by the control plane via the K8s API.
The Helm Chart is for cloud-hosted and enterprise private deployment scenarios. For local single-user setups, use the Desktop App or Local Deployment instead.

​
Prerequisites

  • Kubernetes cluster (v1.25+)
  • Helm 3.10+
  • kubectl configured for your cluster
  • A pre-created Kubernetes Secret containing at minimum JWT_SECRET

​
Quick Start

# 1. Create the required secret
kubectl create secret generic myrm-secrets \
  --from-literal=JWT_SECRET=$(openssl rand -hex 32) \
  --from-literal=MYRM_CP_ADMIN_API_KEY=$(openssl rand -hex 32)

# 2. Install the chart
helm install myrm deploy/helm/myrm-platform/ -f my-values.yaml

# 3. Access the frontend
kubectl port-forward svc/myrm-frontend 3000:3000
# Open http://localhost:3000

​
Architecture

┌─────────────────────────────────────────────┐
│                  Ingress                     │
│  frontend.host → Frontend Service (3000)     │
│  api.host      → CP Service (8003)           │
└──────────────┬────────────┬─────────────────┘
               │            │
     ┌─────────▼──┐  ┌──────▼──────────┐
     │  Frontend   │  │  Control Plane   │
     │ (Next.js)   │  │  (FastAPI)       │
     │  Deployment │  │  Deployment      │
     └─────────────┘  │  + PVC (/data)   │
                      │  + ServiceAccount │
                      └──────┬───────────┘
                             │ K8s API
                    ┌────────▼────────┐
                    │  Sandbox Pods    │
                    │  (per-user,      │
                    │   dynamic)       │
                    └─────────────────┘

​
Configuration

All configuration is centralized in values.yaml. The chart maps 1:1 to the control plane’s ControlPlaneConfig fields.

​
Images

images:
  controlPlane:
    repository: ghcr.io/myrmagent/myrm-control-plane
    tag: ""          # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  frontend:
    repository: ghcr.io/myrmagent/myrm-frontend
    tag: ""
    pullPolicy: IfNotPresent

global:
  imagePullSecrets: []
  #   - name: my-registry-secret

​
Secrets

The chart uses an external Secret pattern — you create the Secret manually, and the chart references it: 
existingSecret: myrm-secrets
Required keys: JWT_SECRET Optional keys: MYRM_CP_STRIPE_SECRET_KEY, MYRM_CP_GOOGLE_OAUTH_CLIENT_SECRET, MYRM_CP_GITHUB_OAUTH_CLIENT_SECRET, MYRM_CP_ADMIN_API_KEY, MYRM_CP_ENTERPRISE_LICENSE_KEY, etc.

​
Ingress

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  frontend:
    host: myrm.example.com
  api:
    host: api.myrm.example.com
  tls:
    - hosts: [myrm.example.com, api.myrm.example.com]
      secretName: myrm-tls

​
Persistence

controlPlane:
  persistence:
    enabled: true
    size: 5Gi
    storageClass: ""    # uses cluster default
    accessModes:
      - ReadWriteOnce

​
RBAC

The control plane needs permissions to manage sandbox Pods via the K8s API: 
rbac:
  create: true
  serviceAccount:
    create: true
    name: ""
    annotations: {}    # e.g. eks.amazonaws.com/role-arn

​
Optional Enterprise Features

All disabled by default — enable as needed:
FeatureConfig KeyPurpose
Network PolicynetworkPolicy.enabledRestrict traffic between components
HPAautoscaling.enabledAuto-scale CP and frontend pods
PDBpodDisruptionBudget.enabledGuarantee availability during upgrades
PrometheusRulemonitoring.prometheusRule.enabledAlert on CP downtime and high latency

​
Example: Production-Ready Configuration

controlPlane:
  replicas: 3
  config:
    edition: enterprise
    runtime: docker
  persistence:
    enabled: true
    size: 50Gi
    storageClass: gp3

frontend:
  replicas: 2

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  frontend:
    host: myrm.mycompany.com
  api:
    host: api.myrm.mycompany.com
  tls:
    - hosts: [myrm.mycompany.com, api.myrm.mycompany.com]
      secretName: myrm-tls

rbac:
  create: true

networkPolicy:
  enabled: true

autoscaling:
  enabled: true
  controlPlane:
    minReplicas: 2
    maxReplicas: 10
    targetCPUUtilizationPercentage: 70

podDisruptionBudget:
  enabled: true
  controlPlane:
    minAvailable: 1

monitoring:
  prometheusRule:
    enabled: true
    severity: critical

​
Upgrading

helm upgrade myrm deploy/helm/myrm-platform/ -f my-values.yaml
The chart uses checksum annotations on ConfigMap and Secret references, so pods automatically restart when configuration changes.

​
Uninstalling

helm uninstall myrm
# PVCs are retained by default — delete manually if needed:
kubectl delete pvc myrm-control-plane-data