fleet-memory/helm/hindsight
Anatolii Lapytskyi ecc1f31996
feat(helm): add existingSecret support (#119)
* feat(helm): add existingSecret support

Allow users to reference a pre-existing Kubernetes Secret instead of
having the chart create one. This enables better secret management
through tools like External Secrets Operator or sealed-secrets.

Usage:
```yaml
existingSecret: "my-pre-created-secret"
```

When existingSecret is set:
- The chart skips creating its own Secret resource
- Deployments reference the provided secret name
- Secret checksum annotation is omitted (no auto-rollout on changes)

The existing secret should contain all required keys:
- API secrets (e.g., HINDSIGHT_API_LLM_API_KEY)
- Control plane secrets
- postgres-password (if using external PostgreSQL)

* fix(helm): use envFrom for existingSecret and fix env var ordering

- Add envFrom to inject all keys from existingSecret as env vars automatically
- Fix POSTGRES_PASSWORD ordering (must be before DATABASE_URL for $(VAR) interpolation)
- Only use api.secrets/controlPlane.secrets when existingSecret is not set
- Update values.yaml documentation for existingSecret usage

---------

Co-authored-by: Anatolii Lapytskyi <ala@herobase.com>
2026-01-08 10:36:03 +01:00
..
templates feat(helm): add existingSecret support (#119) 2026-01-08 10:36:03 +01:00
.helmignore rename to hindsight (#2) 2025-11-25 19:28:26 +01:00
Chart.lock helm chart updates v1 2025-12-10 17:30:15 +01:00
Chart.yaml Release v0.2.1 2026-01-05 12:36:49 +01:00
README.md helm chart updates v1 2025-12-10 17:30:15 +01:00
values.yaml feat(helm): add existingSecret support (#119) 2026-01-08 10:36:03 +01:00

Hindsight Helm Chart

Helm chart for deploying Hindsight - a temporal-semantic-entity memory system for AI agents.

Prerequisites

  • Kubernetes 1.19+
  • Helm 3.0+
  • PostgreSQL database (external or bundled)

Quick Start

# Update dependencies first
helm dependency update ./helm/hindsight

# Install (PostgreSQL included by default)
export OPENAI_API_KEY="sk-your-openai-key"
helm upgrade hindsight --install ./helm/hindsight -n hindsight --create-namespace \
  --set api.secrets.HINDSIGHT_API_LLM_API_KEY="$OPENAI_API_KEY"

To use an external database instead:

helm install hindsight ./helm/hindsight -n hindsight --create-namespace \
  --set api.secrets.HINDSIGHT_API_LLM_API_KEY="sk-your-openai-key" \
  --set postgresql.enabled=false \
  --set postgresql.external.host=my-postgres.example.com \
  --set postgresql.external.password=mypassword

Installation

Add the repository (if published)

helm repo add hindsight https://your-helm-repo.com
helm repo update

Install with custom values file

Create a values-override.yaml:

api:
  secrets:
    HINDSIGHT_API_LLM_API_KEY: "sk-your-openai-key"

postgresql:
  external:
    host: "my-postgres.example.com"
    password: "mypassword"

Then install:

helm install hindsight ./helm/hindsight -n hindsight --create-namespace -f values-override.yaml

Configuration

Key Values

Parameter Description Default
version Default image tag for all components 0.1.0
api.enabled Enable the API component true
api.image.repository API image repository hindsight/api
api.image.tag API image tag (defaults to version) -
api.service.port API service port 8888
controlPlane.enabled Enable the control plane true
controlPlane.image.repository Control plane image repository hindsight/control-plane
controlPlane.image.tag Control plane image tag (defaults to version) -
controlPlane.service.port Control plane service port 3000
postgresql.enabled Deploy PostgreSQL as subchart true
postgresql.external.host External PostgreSQL host postgresql
postgresql.external.port External PostgreSQL port 5432
postgresql.external.database Database name hindsight
postgresql.external.username Database username hindsight
ingress.enabled Enable ingress false
autoscaling.enabled Enable HPA false

Environment Variables

All environment variables in api.env and controlPlane.env are automatically added to the respective pods. Sensitive values should go in api.secrets or controlPlane.secrets.

api:
  env:
    HINDSIGHT_API_LLM_PROVIDER: "openai"
    HINDSIGHT_API_LLM_MODEL: "gpt-4"
  secrets:
    HINDSIGHT_API_LLM_API_KEY: "your-api-key"
    HINDSIGHT_API_LLM_BASE_URL: "https://api.openai.com/v1"

controlPlane:
  env:
    NODE_ENV: "production"
  secrets: {}

External Database

To connect to an external PostgreSQL database:

postgresql:
  enabled: false
  external:
    host: "my-postgres.example.com"
    port: 5432
    database: "hindsight"
    username: "hindsight"
    password: "your-password"

Ingress

To expose the services via ingress:

ingress:
  enabled: true
  className: "nginx"
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
  hosts:
    - host: hindsight.example.com
      paths:
        - path: /
          pathType: Prefix
          service: controlPlane
        - path: /api
          pathType: Prefix
          service: api
  tls:
    - secretName: hindsight-tls
      hosts:
        - hindsight.example.com

Upgrading

helm upgrade hindsight ./helm/hindsight -n hindsight

Uninstalling

helm uninstall hindsight -n hindsight

Components

The chart deploys:

  • API: The main Hindsight API server for memory operations
  • Control Plane: Web UI for managing agents and viewing memories

Development

Lint the chart

helm lint ./helm/hindsight

Template locally

helm template hindsight ./helm/hindsight --debug

Dry run installation

helm install hindsight ./helm/hindsight --dry-run --debug