Kubernetes and Helm Tips for Agent Mesh

Solace Agent Mesh
1

The desktop app is where I build. Kubernetes is where things go to live. Here’s what I’ve picked up deploying Solace Agent Mesh with its Helm chart.

Start with the defaults, but know what they are

The quick start install needs no values file at all:

helm install sam ./solace-agent-mesh-<version>.tar.gz \
  --namespace sam --create-namespace \
  --set-file global.imagePullKey=sam-pull-credentials.json

That gives you an embedded broker, bundled PostgreSQL and object storage, and authorization off. Great for an evaluation. None of it is meant for production.

Production means turning the embedded parts off

global:
  broker:
    embedded: false
  persistence:
    enabled: false
    namespaceId: "northwind-prod"
broker:
  url: "tcps://your-broker.messaging.solace.cloud:55443"
  vpn: "your-vpn"
  clientUsername: "your-username"
sam:
  authorization:
    enabled: true
  dnsName: "agents.example.com"
extraSecretEnvironmentVars:
  - envName: LLM_SERVICE_API_KEY
    secretName: sam-llm
    secretKey: api-key

Tips that saved me time:

  1. Give every install its own namespaceId. It scopes database users and broker topics. Two installs on the same broker with the same ID will step on each other.
  2. Keep secrets out of values files. extraSecretEnvironmentVars pulls them from existing Kubernetes Secrets. environmentVariables renders into a ConfigMap in plain text, so use it only for non-secret settings like SAM_FEATURE_* flags or proxy variables.
  3. Dry run first. helm install ... --dry-run -f production-values.yaml renders everything and reports config errors without creating anything. The chart also runs a pre-install check that confirms referenced Secrets, ConfigMaps and the StorageClass exist.
  4. Rotated a Secret? Restart. Pods read secrets and CA bundles at startup, so follow up with kubectl rollout restart.
  5. Upgrading from quick start to production is helm upgrade with your production values. Data in the embedded database is not migrated for you, so plan for that.

Before exposing anything, port-forward to check it’s up:

kubectl port-forward -n sam svc/sam-solace-agent-mesh-gwe 8080:80

Docs:

Building locally first makes the cluster part boring, in a good way. Download the Solace Agent Mesh desktop app and use the same YAML from laptop to cluster.

What’s your setup: EKS, AKS, GKE, or on-prem? Share your gotchas in the replies so the next person doesn’t hit them.