# Kubernetes and Helm Tips for Agent Mesh

**URL:** <https://community.solace.com/t/kubernetes-and-helm-tips-for-agent-mesh/4956>\
**Category:** Solace Agent Mesh\
**Created:** [November 13, 2026, 6:33pm UTC](https://community.solace.com/t/kubernetes-and-helm-tips-for-agent-mesh/4956 "2026-11-13T18:33:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tamimi](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/tamimi/32/2190_2.png) [@Tamimi](https://community.solace.com/u/Tamimi)\
**Post date:** [November 13, 2026, 6:33pm UTC](https://community.solace.com/t/kubernetes-and-helm-tips-for-agent-mesh/4956/1 "2026-11-13T18:33:24Z")

</div>

The desktop app is where I build. Kubernetes is where things go to live. Here’s what I’ve picked up deploying Solace Agent Mesh with its Helm chart.

**Start with the defaults, but know what they are**

The quick start install needs no values file at all:

```bash
helm install sam ./solace-agent-mesh-<version>.tar.gz \
  --namespace sam --create-namespace \
  --set-file global.imagePullKey=sam-pull-credentials.json

```

That gives you an embedded broker, bundled PostgreSQL and object storage, and authorization off. Great for an evaluation. None of it is meant for production.

**Production means turning the embedded parts off**

```yaml
global:
  broker:
    embedded: false
  persistence:
    enabled: false
    namespaceId: "northwind-prod"
broker:
  url: "tcps://your-broker.messaging.solace.cloud:55443"
  vpn: "your-vpn"
  clientUsername: "your-username"
sam:
  authorization:
    enabled: true
  dnsName: "agents.example.com"
extraSecretEnvironmentVars:
  - envName: LLM_SERVICE_API_KEY
    secretName: sam-llm
    secretKey: api-key

```

Tips that saved me time:

1. **Give every install its own `namespaceId`.** It scopes database users and broker topics. Two installs on the same broker with the same ID will step on each other.
2. **Keep secrets out of values files.** `extraSecretEnvironmentVars` pulls them from existing Kubernetes Secrets. `environmentVariables` renders into a ConfigMap in plain text, so use it only for non-secret settings like `SAM_FEATURE_*` flags or proxy variables.
3. **Dry run first.** `helm install ... --dry-run -f production-values.yaml` renders everything and reports config errors without creating anything. The chart also runs a pre-install check that confirms referenced Secrets, ConfigMaps and the StorageClass exist.
4. **Rotated a Secret? Restart.** Pods read secrets and CA bundles at startup, so follow up with `kubectl rollout restart`.
5. **Upgrading from quick start** to production is `helm upgrade` with your production values. Data in the embedded database is not migrated for you, so plan for that.

Before exposing anything, port-forward to check it’s up:

```bash
kubectl port-forward -n sam svc/sam-solace-agent-mesh-gwe 8080:80

```

Docs:

- [Deploying with Kubernetes](https://docs.solace.com/Agent-Mesh/Framework/installing/kubernetes/index.htm)
- [Installing Kubernetes for Production](https://docs.solace.com/Agent-Mesh/Framework/installing/kubernetes/production.htm)
- [Helm Values Reference](https://docs.solace.com/Agent-Mesh/Framework/reference/helm-values.htm)

Building locally first makes the cluster part boring, in a good way. [Download the Solace Agent Mesh desktop app](https://solace.com/products/agent-mesh/) and use the same YAML from laptop to cluster.

What’s your setup: EKS, AKS, GKE, or on-prem? Share your gotchas in the replies so the next person doesn’t hit them.