Evaluation
The chart's defaults are already sized for a local kind install. Nothing here is suitable for production.
What "evaluation defaults" means
Setting postgresql.enabled: true, minio.enabled: true, or keycloak.enabled: true does not install those services. It only wires the app to an in-cluster service named <release>-<service>. You still install them yourself, typically from the Bitnami charts with a matching release name.
That decoupling is deliberate: it keeps deploys deterministic and free of third-party chart-registry coupling. It also means "enabled: true" is not the shortcut it looks like.
Minimal install
kubectl create namespace presponsieve
kubectl create secret generic presponsieve-secrets -n presponsieve \
--from-literal=APP_KEK="$(openssl rand -base64 32)" \
--from-literal=SESSION_SECRET="$(openssl rand -base64 32)" \
--from-literal=INDEX_PEPPER="$(openssl rand -base64 32)" \
--from-literal=AUTH_TOKEN_PEPPER="$(openssl rand -base64 32)" \
--from-literal=LICENSE_KEY="$LICENSE_KEY"
helm upgrade --install presponsieve \
oci://ghcr.io/m-a-m-a-ai/charts/presponsievelite \
-n presponsieve \
--set image.tag=0.1.0 \
--set app.existingSecret=presponsieve-secrets \
--set postgresql.enabled=false \
--set externalDatabase.url="postgresql+psycopg2://user:pass@postgres:5432/presponsieve" \
--set minio.enabled=false \
--set externalObjectStore.bucket=presponsieve-artifacts \
--set keycloak.enabled=false \
--set ingress.enabled=false \
--set replicaCount=1
With ingress.enabled=false, reach it by port-forward:
kubectl port-forward -n presponsieve svc/presponsieve 8080:80
Signing in without an identity provider
Break-glass login tokens exist for exactly this. Add ACCESS_TOKENS to the application secret and sign in with one.
ACCESS_TOKENS bypasses your identity provider, your MFA, and your offboarding process. It is a bootstrap mechanism. Remove it from the secret once SSO works, and do not carry it into production because it was convenient during evaluation.
What is different from production
| Evaluation | Production | |
|---|---|---|
| Database | Anything reachable | Managed, HA, point-in-time recovery |
| Replicas | 1 | 2+, autoscaled |
| TLS | Port-forward, none | At the load balancer |
| Sign-in | ACCESS_TOKENS | OIDC or IAP |
| Secrets | kubectl create secret | External Secrets or Sealed Secrets |
| KEK | APP_KEK in the secret | KMS_BACKEND against a real KMS |
The analysis output is identical, so an integration built against an evaluation install works unchanged against production.
Tearing down
helm uninstall presponsieve -n presponsieve
That leaves the external database and bucket intact. Delete them separately if you want the data gone.