This Helm chart deploys Sim, a lightweight AI agent workflow platform, on Kubernetes.

• Kubernetes 1.19+
• Helm 3.0+
• PV provisioner support in the underlying infrastructure (for persistent storage)

Install the chart from this repository:

# From the repository root
helm install sim ./helm/sim

Install with custom values:

helm install sim ./helm/sim -f custom-values.yaml

The chart includes several pre-configured values files for different scenarios:

helm install sim-dev ./helm/sim \
  --values ./helm/sim/examples/values-development.yaml \
  --namespace simstudio-dev --create-namespace

helm install sim-prod ./helm/sim \
  --values ./helm/sim/examples/values-production.yaml \
  --namespace simstudio-prod --create-namespace

helm install sim-azure ./helm/sim \
  --values ./helm/sim/examples/values-azure.yaml \
  --namespace simstudio --create-namespace

helm install sim-aws ./helm/sim \
  --values ./helm/sim/examples/values-aws.yaml \
  --namespace simstudio --create-namespace

helm install sim-gcp ./helm/sim \
  --values ./helm/sim/examples/values-gcp.yaml \
  --namespace simstudio --create-namespace

helm install sim-prod ./helm/sim \
  --values ./helm/sim/examples/values-external-db.yaml \
  --set externalDatabase.host="your-rds-endpoint.com" \
  --set externalDatabase.username="simstudio_user" \
  --set externalDatabase.password="secure-password" \
  --set externalDatabase.database="simstudio_prod" \
  --namespace simstudio --create-namespace

Each cloud platform example includes optimized configurations:

• Storage: Premium managed disks (managed-csi-premium)
• Node Selectors: Role-based node targeting (node-role: application, node-role: datalake)
• GPU Support: NVIDIA GPU nodes with tolerations
• Ingress: NGINX ingress controller with SSL redirect

• Storage: EBS GP3 volumes for optimal performance
• EBS CSI Driver: Required for persistent storage (install as EKS add-on)
• Node Selectors: Instance type targeting (t3.large, r5.large, g4dn.xlarge)
• GPU Support: GPU-optimized instances (G4, P3 families)
• Ingress: Application Load Balancer (ALB) with AWS Certificate Manager
• IAM: Service Account annotations for IAM roles

Prerequisites for AWS:

# Install EBS CSI driver add-on
aws eks create-addon --cluster-name your-cluster --addon-name aws-ebs-csi-driver

# Create IAM role for EBS CSI driver (if using IRSA)
aws iam create-role --role-name AmazonEKS_EBS_CSI_DriverRole \
  --assume-role-policy-document file://ebs-csi-trust-policy.json
aws iam attach-role-policy --role-name AmazonEKS_EBS_CSI_DriverRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy

• Storage: Persistent Disk with standard and premium options
• Node Selectors: Node pool and machine family targeting
• GPU Support: Tesla T4/V100 GPUs with GKE accelerator labels
• Ingress: Google Cloud Load Balancer with managed certificates
• Workload Identity: Service Account annotations for GCP IAM

The following table lists the configurable parameters and their default values.

Enable automatic horizontal scaling based on CPU and memory usage:

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 20
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

Enable shared storage for multi-pod data sharing and enterprise workflows:

sharedStorage:
  enabled: true
  storageClass: "managed-csi-premium"
  volumes:
    - name: output-share
      size: 100Gi
      accessModes:
        - ReadWriteMany
    - name: model-share
      size: 200Gi
      accessModes:
        - ReadWriteMany
    - name: logs-share
      size: 50Gi
      accessModes:
        - ReadWriteMany

This creates persistent volume claims that can be shared across multiple pods for:

• Output data sharing between workflow steps
• Model storage and caching
• Centralized logging and audit trails
• Temporary data exchange

Enable comprehensive telemetry collection with OpenTelemetry:

telemetry:
  enabled: true
  resources:
    limits:
      memory: "1Gi"
      cpu: "500m"
    requests:
      memory: "512Mi"
      cpu: "200m"
  
  # Enable Jaeger for distributed tracing
  jaeger:
    enabled: true
    endpoint: "http://jaeger-collector:14250"
  
  # Enable Prometheus for metrics
  prometheus:
    enabled: true
    endpoint: "http://prometheus-server/api/v1/write"
    auth: "Bearer your-prometheus-token"
  
  # Enable generic OTLP for flexibility
  otlp:
    enabled: true
    endpoint: "http://otlp-collector:4317"

This automatically configures:

• OpenTelemetry Collector for metrics, traces, and logs
• Automatic service discovery for Sim components
• Environment variable injection for applications
• Support for multiple observability backends

Enable GPU device plugin support for AI workloads:

ollama:
  enabled: true
  gpu:
    enabled: true
    count: 1
  nodeSelector:
    accelerator: nvidia
  tolerations:
    - key: "sku"
      operator: "Equal"
      value: "gpu"
      effect: "NoSchedule"

This deploys:

• NVIDIA Device Plugin DaemonSet
• RuntimeClass for NVIDIA container runtime
• Proper node scheduling and resource allocation

Enable Prometheus monitoring with ServiceMonitor:

monitoring:
  serviceMonitor:
    enabled: true
    labels:
      monitoring: "prometheus"
    interval: 15s

Enable network policies for micro-segmentation:

networkPolicy:
  enabled: true

This creates network policies that:

• Allow communication between Sim components
• Restrict unnecessary network access
• Permit DNS resolution and HTTPS egress
• Support custom ingress/egress rules

Enable automated scheduled tasks functionality:

cronjobs:
  enabled: true
  
  # Customize individual jobs
  jobs:
    scheduleExecution:
      enabled: true
      schedule: "*/1 * * * *"  # Every minute
    
    gmailWebhookPoll:
      enabled: true
      schedule: "*/1 * * * *"  # Every minute
    
    outlookWebhookPoll:
      enabled: true
      schedule: "*/1 * * * *"  # Every minute
    
      
  # Global job configuration
  resources:
    limits:
      memory: "256Mi"
      cpu: "200m"
    requests:
      memory: "128Mi"
      cpu: "100m"

This creates Kubernetes CronJob resources that:

• Execute HTTP requests to your application's API endpoints
• Handle retries and error logging automatically
• Use minimal resources with curl-based containers
• Support individual enable/disable per job
• Follow Kubernetes security best practices

Configure pod disruption budgets and anti-affinity:

podDisruptionBudget:
  enabled: true
  minAvailable: 1

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values: ["simstudio"]
          topologyKey: kubernetes.io/hostname

To upgrade your release:

helm upgrade sim ./helm/sim

To uninstall/delete the release:

helm uninstall sim

The chart supports integration with external secret management systems for production-grade secret handling. This enables you to store secrets in secure vaults and have them automatically synced to Kubernetes.

External Secrets Operator is the industry-standard solution for syncing secrets from external stores like Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, and GCP Secret Manager.

Prerequisites:

# Install External Secrets Operator
helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets \
  -n external-secrets --create-namespace

Configuration:

externalSecrets:
  enabled: true
  refreshInterval: "1h"
  secretStoreRef:
    name: "my-secret-store"
    kind: "ClusterSecretStore"
  remoteRefs:
    app:
      BETTER_AUTH_SECRET: "sim/app/better-auth-secret"
      ENCRYPTION_KEY: "sim/app/encryption-key"
      INTERNAL_API_SECRET: "sim/app/internal-api-secret"
    postgresql:
      password: "sim/postgresql/password"

See examples/values-external-secrets.yaml for complete examples including SecretStore configurations for Azure, AWS, GCP, and Vault.

Reference secrets you've created manually, via GitOps (Sealed Secrets, SOPS), or through other automation.

Configuration:

app:
  secrets:
    existingSecret:
      enabled: true
      name: "my-app-secrets"

postgresql:
  auth:
    existingSecret:
      enabled: true
      name: "my-postgresql-secret"
      passwordKey: "POSTGRES_PASSWORD"

externalDatabase:
  existingSecret:
    enabled: true
    name: "my-external-db-secret"
    passwordKey: "password"

Create secrets manually:

# Generate secure values
BETTER_AUTH_SECRET=$(openssl rand -hex 32)
ENCRYPTION_KEY=$(openssl rand -hex 32)
INTERNAL_API_SECRET=$(openssl rand -hex 32)
POSTGRES_PASSWORD=$(openssl rand -base64 16 | tr -d '/+=')

# Create app secrets
kubectl create secret generic my-app-secrets \
  --namespace sim \
  --from-literal=BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
  --from-literal=ENCRYPTION_KEY="$ENCRYPTION_KEY" \
  --from-literal=INTERNAL_API_SECRET="$INTERNAL_API_SECRET"

# Create PostgreSQL secret
kubectl create secret generic my-postgresql-secret \
  --namespace sim \
  --from-literal=POSTGRES_PASSWORD="$POSTGRES_PASSWORD"

See examples/values-existing-secret.yaml for more details.

The Helm chart enables the BullMQ worker by default so the deployment topology matches Docker Compose. If REDIS_URL is not configured, the worker pod will still start but remain idle and do no queue processing. This is expected.

Queue-backed API, webhook, and schedule execution requires Redis. Installs without Redis continue to use the inline execution path. If you do not want the worker pod at all, set:

worker:
  enabled: false

For production deployments, make sure to:

1. Change default secrets: Update BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET with secure, randomly generated values using openssl rand -hex 32
2. Use strong database passwords: Set postgresql.auth.password to a strong password
3. Enable TLS: Configure postgresql.tls.enabled=true and provide proper certificates
4. Configure ingress TLS: Enable HTTPS with proper SSL certificates

Required Secrets:

• BETTER_AUTH_SECRET: Authentication JWT signing (minimum 32 characters)
• ENCRYPTION_KEY: Encrypts sensitive data like environment variables (minimum 32 characters)
• INTERNAL_API_SECRET: Internal service-to-service authentication (minimum 32 characters)

Optional Security (Recommended for Production):

• CRON_SECRET: Authenticates scheduled job requests to API endpoints (required only if cronjobs.enabled=true)
• API_ENCRYPTION_KEY: Encrypts API keys at rest in database (must be exactly 64 hex characters). If not set, API keys are stored in plain text. Generate using: openssl rand -hex 32 (outputs 64 hex chars representing 32 bytes)

app:
  env:
    BETTER_AUTH_SECRET: "your-secure-random-string-here"
    ENCRYPTION_KEY: "your-secure-encryption-key-here"
    INTERNAL_API_SECRET: "your-secure-internal-api-secret-here"
    CRON_SECRET: "your-secure-cron-secret-here"
    API_ENCRYPTION_KEY: "your-64-char-hex-string-for-api-key-encryption"  # Optional but recommended

postgresql:
  auth:
    password: "your-secure-database-password"
  tls:
    enabled: true
    certificatesSecret: "postgres-tls-secret"

ingress:
  enabled: true
  tls:
    enabled: true
    secretName: "simstudio-tls-secret"

1. Database Connection Issues

   • Check if PostgreSQL pod is running: kubectl get pods -l app.kubernetes.io/component=postgresql
   • Verify database credentials in the secret: kubectl get secret <release>-postgresql-secret -o yaml

2. Migration Issues

   • Check migration job logs: kubectl logs job/<release>-migrations
   • Ensure database is accessible from the migration job

3. Image Pull Issues

   • Verify image names and tags in values.yaml
   • Check if image pull secrets are configured correctly

# App logs
kubectl logs deployment/<release>-app

# Realtime logs
kubectl logs deployment/<release>-realtime

# PostgreSQL logs
kubectl logs statefulset/<release>-postgresql

# Migration logs
kubectl logs job/<release>-migrations

• Documentation: https://docs.sim.ai
• GitHub Issues: https://github.com/simstudioai/sim/issues
• Discord: https://discord.gg/Hr4UWYEcTT