Install the chart

The chart lives in an OCI registry, so there is nothing to clone and no values file to keep on disk. Helm pulls it straight from ghcr.io/solvegio/charts/platform.

helm install my-mvno oci://ghcr.io/solvegio/charts/platform --version <chart-version> \
  --namespace my-mvno --create-namespace \
  --set platform.kind=mvno \
  --set platform.host=esim.acme.com \
  --set activation.code=<code-from-the-hub-console>

That is the whole install. Before you run it, make sure the cluster already has ingress-nginx, cert-manager with a ClusterIssuer named letsencrypt-prod, and CloudNativePG and Strimzi (Postgres and Kafka run under an operator by default). Prerequisites walks through all four, with ./deploy/scripts/install-prereqs.sh as the one-command path.

Pin the chart version

--version <chart-version> is not optional in any install you intend to keep. Without it Helm resolves whatever the registry currently calls latest, which means the release you install this afternoon can differ from the one you installed this morning, and the diff is invisible in your own repo. A pinned version resolves to the same chart every time, so a re-install, a rollback, and a colleague running the same command all land on the same templates.

Upgrading is then a deliberate act: bump the version, read what changed, run helm upgrade.

The two values

Everything in this chart either defaults, derives itself, or gets generated on first install. Two values have no sensible default, and the chart refuses to render without them.

platform.host is the public hostname your API serves on. It is the host in the Ingress rule and the host on the TLS certificate, so it has to be the name your DNS actually points at the cluster. See DNS and TLS.

activation.code is the one-time code you mint in the Hub console for this specific deployment. The license agent redeems it once, inside your cluster, and writes the resulting license into your namespace. Activation covers where the code comes from and what happens to it.

Where the role comes from

platform.kind decides whether this release is an MVNE console or an MVNO storefront. It is the only other flag on the command above, and it is enough: the API image (solvegio/mvno-api) and the web image (solvegio/mvno) derive from it, along with the Kafka client id and the event topic names.

Installing from a repo checkout instead, the alias files do the same job:

helm install my-mvno deploy/helm/platform -f deploy/helm/platform/values-mvno.yaml \
  --namespace my-mvno --create-namespace \
  --set platform.host=esim.acme.com \
  --set activation.code=<code-from-the-hub-console>

values-mvno.yaml and values-mvne.yaml set platform.kind and nothing else. Both forms render identically.

Private images

The first-party images ship from GHCR. If your account pulls them from a private package, create a dockerconfigjson Secret in the release namespace and point the chart at it:

kubectl create secret docker-registry ghcr-pull \
  --docker-server=ghcr.io --docker-username=<user> --docker-password=<pat> \
  -n my-mvno

Then add --set imagePullSecret=ghcr-pull to the install. Public images, or images already imported into the node runtime, need no pull secret. Mirroring the images into a registry of your own is covered in Registry and airgap.

Look before you install

helm template renders every object without touching the cluster:

helm template my-mvno oci://ghcr.io/solvegio/charts/platform --version <chart-version> \
  --set platform.kind=mvno \
  --set platform.host=esim.acme.com \
  --set activation.code=<code-from-the-hub-console>

This is worth doing once, if only to see how small the surface is: an API Deployment, GoTrue, the license agent, a CNPG Cluster and a Strimzi Kafka (or nothing, in external mode), a bundled Redis StatefulSet, a Secret, a ConfigMap, and an Ingress.

Changing anything later

helm upgrade is the normal way to change a running install, including the ones that sound alarming.

helm upgrade my-mvno oci://ghcr.io/solvegio/charts/platform --version <chart-version> \
  --namespace my-mvno \
  --set platform.kind=mvno \
  --set platform.host=esim.acme.com \
  --set activation.code=<code-from-the-hub-console> \
  --set api.replicas=2

Every --set you leave off reverts to the chart default, so keep the full set of values you care about in a file and pass it with -f once the command gets long.

The values the chart generated for you on first install (the JWT secret, the age keypair, the Postgres and Redis passwords) survive an upgrade. The chart looks up the live Secret and reuses what is already there rather than minting new values, so an upgrade never rotates a credential a running platform depends on. The same is true of the license: the agent owns it, and an upgrade does not disturb it.

The full list of values, with defaults, is in Helm values. Bringing your own Postgres, Redis, or Kafka is in Data services.

Once the release is up, Verify your install tells you how to know it actually worked. If it does not, start at Install failures.