Kubernetes (Helm Chart)

Overview

The official myrm-platform Helm Chart deploys the control plane + frontend as a dual-component release on any Kubernetes cluster. Sandbox instances (one per user) are dynamically created by the control plane via the K8s API.

The Helm Chart is for cloud-hosted and enterprise private deployment scenarios. For local single-user setups, use the Desktop App or Local Deployment instead.

Prerequisites

Kubernetes cluster (v1.25+)
Helm 3.10+
kubectl configured for your cluster
A pre-created Kubernetes Secret containing at minimum JWT_SECRET

Quick Start

# 1. Create the required secret
kubectl create secret generic myrm-secrets \
  --from-literal=JWT_SECRET=$(openssl rand -hex 32) \
  --from-literal=MYRM_CP_ADMIN_API_KEY=$(openssl rand -hex 32)

# 2. Install the chart
helm install myrm deploy/helm/myrm-platform/ -f my-values.yaml

# 3. Access the frontend
kubectl port-forward svc/myrm-frontend 3000:3000
# Open http://localhost:3000

Architecture

┌─────────────────────────────────────────────┐
│                  Ingress                     │
│  frontend.host → Frontend Service (3000)     │
│  api.host      → CP Service (8003)           │
└──────────────┬────────────┬─────────────────┘
               │            │
     ┌─────────▼──┐  ┌──────▼──────────┐
     │  Frontend   │  │  Control Plane   │
     │ (Next.js)   │  │  (FastAPI)       │
     │  Deployment │  │  Deployment      │
     └─────────────┘  │  + PVC (/data)   │
                      │  + ServiceAccount │
                      └──────┬───────────┘
                             │ K8s API
                    ┌────────▼────────┐
                    │  Sandbox Pods    │
                    │  (per-user,      │
                    │   dynamic)       │
                    └─────────────────┘

Configuration

All configuration is centralized in values.yaml. The chart maps 1:1 to the control plane’s ControlPlaneConfig fields.

Images

images:
  controlPlane:
    repository: ghcr.io/myrmagent/myrm-control-plane
    tag: ""          # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  frontend:
    repository: ghcr.io/myrmagent/myrm-frontend
    tag: ""
    pullPolicy: IfNotPresent

global:
  imagePullSecrets: []
  #   - name: my-registry-secret

Secrets

The chart uses an external Secret pattern — you create the Secret manually, and the chart references it:

existingSecret: myrm-secrets

Required keys: JWT_SECRET Optional keys: MYRM_CP_STRIPE_SECRET_KEY, MYRM_CP_GOOGLE_OAUTH_CLIENT_SECRET, MYRM_CP_GITHUB_OAUTH_CLIENT_SECRET, MYRM_CP_ADMIN_API_KEY, MYRM_CP_ENTERPRISE_LICENSE_KEY, etc.

Ingress

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  frontend:
    host: myrm.example.com
  api:
    host: api.myrm.example.com
  tls:
    - hosts: [myrm.example.com, api.myrm.example.com]
      secretName: myrm-tls

Persistence

controlPlane:
  persistence:
    enabled: true
    size: 5Gi
    storageClass: ""    # uses cluster default
    accessModes:
      - ReadWriteOnce

RBAC

The control plane needs permissions to manage sandbox Pods via the K8s API:

rbac:
  create: true
  serviceAccount:
    create: true
    name: ""
    annotations: {}    # e.g. eks.amazonaws.com/role-arn

Optional Enterprise Features

All disabled by default — enable as needed:

Feature	Config Key	Purpose
Network Policy	`networkPolicy.enabled`	Restrict traffic between components
HPA	`autoscaling.enabled`	Auto-scale CP and frontend pods
PDB	`podDisruptionBudget.enabled`	Guarantee availability during upgrades
PrometheusRule	`monitoring.prometheusRule.enabled`	Alert on CP downtime and high latency

Example: Production-Ready Configuration

controlPlane:
  replicas: 3
  config:
    edition: enterprise
    runtime: docker
  persistence:
    enabled: true
    size: 50Gi
    storageClass: gp3

frontend:
  replicas: 2

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  frontend:
    host: myrm.mycompany.com
  api:
    host: api.myrm.mycompany.com
  tls:
    - hosts: [myrm.mycompany.com, api.myrm.mycompany.com]
      secretName: myrm-tls

rbac:
  create: true

networkPolicy:
  enabled: true

autoscaling:
  enabled: true
  controlPlane:
    minReplicas: 2
    maxReplicas: 10
    targetCPUUtilizationPercentage: 70

podDisruptionBudget:
  enabled: true
  controlPlane:
    minAvailable: 1

monitoring:
  prometheusRule:
    enabled: true
    severity: critical

Upgrading

helm upgrade myrm deploy/helm/myrm-platform/ -f my-values.yaml

The chart uses checksum annotations on ConfigMap and Secret references, so pods automatically restart when configuration changes.

Graceful Shutdown for Sandbox Pods

Each sandbox pod runs a Myrm Agent Server instance with built-in Gateway Drain Control. During rolling updates or pod evictions:

The pod receives SIGTERM from Kubernetes.
The AgentGateway enters draining mode — new Agent requests are rejected with a user-friendly message.
In-flight Agent turns get up to 120 seconds to complete naturally.
After the drain timeout, remaining tasks are safely interrupted.

To allow the drain to complete, ensure your sandbox pod template sets an adequate grace period:

terminationGracePeriodSeconds: 150   # 120s drain + 30s buffer

If using PDB (Pod Disruption Budget), this ensures zero-downtime upgrades with no lost Agent work.

Uninstalling

helm uninstall myrm
# PVCs are retained by default — delete manually if needed:
kubectl delete pvc myrm-control-plane-data

Getting Started

Core Concepts

Guides

Self-Hosting

Kubernetes (Helm Chart)

Overview

Prerequisites

Quick Start

Architecture

Configuration

Images

Secrets

Ingress

Persistence

RBAC

Optional Enterprise Features

Example: Production-Ready Configuration

Upgrading

Graceful Shutdown for Sandbox Pods

Uninstalling

​Overview

​Prerequisites

​Quick Start

​Architecture

​Configuration

​Images

​Secrets

​Ingress

​Persistence

​RBAC

​Optional Enterprise Features

​Example: Production-Ready Configuration

​Upgrading

​Graceful Shutdown for Sandbox Pods

​Uninstalling

Overview

Prerequisites

Quick Start

Architecture

Configuration

Images

Secrets

Ingress

Persistence

RBAC

Optional Enterprise Features

Example: Production-Ready Configuration

Upgrading

Graceful Shutdown for Sandbox Pods

Uninstalling