Deploying Tines with Helm

Last updated November 9, 2026

Deploy Tines to Kubernetes using the official Helm chart. This guide covers the prerequisites, OpenShift setup, installation, and verification.

Share the prerequisites with your infrastructure and network administrators before beginning the installation.

Before you begin

You need:

A running Kubernetes cluster, such as Amazon EKS, Azure AKS, Google GKE, or an equivalent.
Helm 3 installed.
kubectl configured to communicate with the target cluster.
A StorageClass that supports ReadWriteOnce persistent volumes.
Access to the container registries used by your chart.
The Tines Helm repository added to Helm.
A values.yaml file prepared using Configuring Tines with Helm.

We recommend a StorageClass with a Retain reclaim policy.

The examples use tines-app as the Helm release name and tines as the namespace. Use your own names consistently if they differ.

OpenShift support is available from chart version 42.0.1. The chart detects OpenShift during installation and selects the OpenShift images. The command runner requires additional permissions, as described below.

Create a namespace

Create a dedicated namespace if it does not already exist:

kubectl create namespace tines

Configure the command runner on OpenShift

On OpenShift, the command runner requires a service account with the anyuid Security Context Constraint (SCC), or an equivalent binding. It uses sudo to switch between users and isolate script execution.

Have your cluster administrator apply the following resources. Save them as tcr-sa.yaml:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tcr-anyuid
  namespace: tines
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tines-command-runner-anyuid
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:anyuid
subjects:
  - kind: ServiceAccount
    name: tcr-anyuid
    namespace: tines

kubectl apply -f tcr-sa.yaml

Add the service account to your values.yaml:

deployments:
  tinesCommandRunner:
    serviceAccountName: tcr-anyuid

Install Tines

Install the chart with your values file:

helm install tines-app tines/tines \
  -n tines \
  -f values.yaml

To install a specific chart version, add --version <chart-version>.

Verify the installation

The chart creates a setup job to initialize the tenant, run database migrations, and sync integration templates.

List the setup jobs:

kubectl get jobs -n tines -l app=tines-app-setup

Use the job name from the output to inspect its logs:

kubectl logs -n tines job/<setup-job-name>

Once the job completes successfully, check the pods:

kubectl get pods -n tines

Confirm the application pods are running and ready. Open the domain configured in initialTenantConfiguration.DOMAIN and sign in with the administrator credentials you configured, or use the invitation email.

Deploy optional components

Confirm that your license includes the component before deploying it.

Tines Tunnel

Tines Tunnel connects Tines Cloud to services in private networks. Follow the Tines Tunnel guide to obtain the tunnel secret.

Save the secret in tunnel-values.yaml:

tunnelSecret: "<your-tunnel-secret>"

Install the standalone chart:

helm install tines-tunnel tines/tines-tunnel \
  -n tines \
  -f tunnel-values.yaml

Command-over-HTTP

Command-over-HTTP runs commands on remote machines through an HTTP bridge. Follow the Command-over-HTTP guide to obtain the secret.

Save it in cohttp-values.yaml:

cohttpSecret: "<your-cohttp-secret>"

Install the standalone chart:

helm install tines-cohttp tines/tines-cohttp \
  -n tines \
  -f cohttp-values.yaml

The standalone chart also supports Kerberos and PowerShell configuration. Inspect its defaults for the available settings:

helm show values tines/tines-cohttp

Next steps

To update Tines or apply configuration changes, see Upgrading Tines with Helm.