---
title: Deploying Tines with Helm
url: https://www.tines.com/stories/docs/self-hosted/deploying-tines/deploying-tines-with-helm/
updated: 2026-11-09T23:21:08+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Self-Hosted](https://www.tines.com/llm/stories/docs/self-hosted.md) › [Deploying Tines](https://www.tines.com/llm/stories/docs/self-hosted/deploying-tines.md)*

# Deploying Tines with Helm

*[View on tines.com](https://www.tines.com/stories/docs/self-hosted/deploying-tines/deploying-tines-with-helm/)*

Deploy Tines to Kubernetes using the official Helm chart. This guide covers the prerequisites, OpenShift setup, installation, and verification.

Share the prerequisites with your infrastructure and network administrators before beginning the installation.

## Before you begin

You need:

- A running Kubernetes cluster, such as Amazon EKS, Azure AKS, Google GKE, or an equivalent.
- Helm 3 installed.
- `kubectl` configured to communicate with the target cluster.
- A StorageClass that supports `ReadWriteOnce` persistent volumes.
- Access to the container registries used by your chart.
- The [Tines Helm repository](https://www.tines.com/stories/docs/self-hosted/getting-started/helm-charts/) added to Helm.
- A `values.yaml` file prepared using [Configuring Tines with Helm](https://www.tines.com/stories/docs/self-hosted/configuring-tines/configuring-tines-with-helm/).

We recommend a StorageClass with a `Retain` reclaim policy.

The examples use `tines-app` as the Helm release name and `tines` as the namespace. Use your own names consistently if they differ.

OpenShift support is available from chart version 42.0.1. The chart detects OpenShift during installation and selects the OpenShift images. The command runner requires additional permissions, as described below.

## Create a namespace

Create a dedicated namespace if it does not already exist:

```shell
kubectl create namespace tines
```

## Configure the command runner on OpenShift

On OpenShift, the command runner requires a service account with the `anyuid` Security Context Constraint (SCC), or an equivalent binding. It uses `sudo` to switch between users and isolate script execution.

Have your cluster administrator apply the following resources. Save them as `tcr-sa.yaml`:

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tcr-anyuid
  namespace: tines
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tines-command-runner-anyuid
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:anyuid
subjects:
  - kind: ServiceAccount
    name: tcr-anyuid
    namespace: tines
```

```shell
kubectl apply -f tcr-sa.yaml
```

Add the service account to your `values.yaml`:

```yaml
deployments:
  tinesCommandRunner:
    serviceAccountName: tcr-anyuid
```

## Install Tines

Install the chart with your values file:

```shell
helm install tines-app tines/tines \
  -n tines \
  -f values.yaml
```

To install a specific chart version, add `--version <chart-version>`.

## Verify the installation

The chart creates a setup job to initialize the tenant, run database migrations, and sync integration templates.

List the setup jobs:

```shell
kubectl get jobs -n tines -l app=tines-app-setup
```

Use the job name from the output to inspect its logs:

```shell
kubectl logs -n tines job/<setup-job-name>
```

Once the job completes successfully, check the pods:

```shell
kubectl get pods -n tines
```

Confirm the application pods are running and ready. Open the domain configured in `initialTenantConfiguration.DOMAIN` and sign in with the administrator credentials you configured, or use the invitation email.

## Deploy optional components

Confirm that your license includes the component before deploying it.

### Tines Tunnel

Tines Tunnel connects Tines Cloud to services in private networks. Follow the [Tines Tunnel guide](https://www.tines.com/stories/docs/admin/tunnel/) to obtain the tunnel secret.

Save the secret in `tunnel-values.yaml`:

```yaml
tunnelSecret: "<your-tunnel-secret>"
```

Install the standalone chart:

```shell
helm install tines-tunnel tines/tines-tunnel \
  -n tines \
  -f tunnel-values.yaml
```

### Command-over-HTTP

Command-over-HTTP runs commands on remote machines through an HTTP bridge. Follow the [Command-over-HTTP guide](https://www.tines.com/stories/docs/admin/command-over-http/) to obtain the secret.

Save it in `cohttp-values.yaml`:

```yaml
cohttpSecret: "<your-cohttp-secret>"
```

Install the standalone chart:

```shell
helm install tines-cohttp tines/tines-cohttp \
  -n tines \
  -f cohttp-values.yaml
```

The standalone chart also supports Kerberos and PowerShell configuration. Inspect its defaults for the available settings:

```shell
helm show values tines/tines-cohttp
```

## Next steps

To update Tines or apply configuration changes, see [Upgrading Tines with Helm](https://www.tines.com/stories/docs/self-hosted/upgrade-tines/upgrading-tines-with-helm/).