Helm Charts

The aisquared Helm chart deploys the AI Squared platform into a Kubernetes cluster. The platform is cloud-agnostic and runs on any conformant cluster, including Amazon EKS, Azure AKS, Google GKE, and MicroK8s.

The chart was renamed from multiwoven to aisquared in version 0.117.0 and is still served from the same Helm repository. If you already run the multiwoven chart, follow Upgrading from the multiwoven chart instead of doing a fresh install.

What gets deployed

Component	Values key	Enabled by default	Purpose
Server	`server`	Yes	Rails API
UI	`ui`	Yes	Web application
Worker	`worker`	Yes	Temporal sync worker
Solid worker	`solidWorker`	Yes	Background job worker
Lightning	`lightning`	Yes	AI model gateway
PostgreSQL	`postgresql`	Yes	In-cluster platform database
Temporal + Temporal UI	`temporal`, `temporalUi`	Yes	In-cluster workflow engine
Box	`box`	No	Sandboxes and released apps for App Builder

The chart also creates:

An Ingress for every public hostname.
cert-manager Issuers for Let’s Encrypt (when NGINX ingress is used).
HorizontalPodAutoscalers for each application component (hpa.enabled: true).
The namespace set in kubernetesNamespace (default aisquared).

The chart does not install an ingress controller or cert-manager. You install those first.

Prerequisites

A Kubernetes cluster and kubectl configured to reach it
Helm 3
A domain you control, with permission to create DNS records
An email address for Let’s Encrypt registration (example.com addresses are rejected)
(Optional) A Temporal Cloud namespace, recommended for production

Hostnames

The platform is exposed on several subdomains. The chart defaults are example.com placeholders, so you must set every one of them:

Values key	Example
`platformConfig.uiHost`	`app.your-domain.com`
`platformConfig.apiHost`	`api.your-domain.com`
`platformConfig.viteApiHost`	`api.your-domain.com` (the API host the UI calls; usually the same as `apiHost`)
`platformConfig.workerHost`	`worker.your-domain.com`
`platformConfig.solidWorkerHost`	`solid.your-domain.com`
`platformConfig.temporalUiHost`	`temporal.your-domain.com` (only when in-cluster Temporal is enabled)
`lightningConfig.lightningHealthHost`	`lightning.your-domain.com`

Install

Install an ingress controller

With the default settings, the chart’s Ingress uses the nginx ingress class. Install the NGINX ingress controller:

helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace

On AWS, you can use the AWS Load Balancer Controller instead. See Ingress options.

The Kubernetes project retired ingress-nginx in March 2026. It still works, but it no longer gets releases or security fixes. The chart currently expects the nginx ingress class (or ALB or Kong), so ingress-nginx is still the default path. For new production clusters on AWS, consider the ALB option.

Install cert-manager

cert-manager requests and renews the Let’s Encrypt certificates.

helm repo add jetstack https://charts.jetstack.io --force-update
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.enabled=true

Create your values file

my-values.yaml

platformConfig:
  uiHost: app.your-domain.com
  apiHost: api.your-domain.com
  viteApiHost: api.your-domain.com
  workerHost: worker.your-domain.com
  solidWorkerHost: solid.your-domain.com
  temporalUiHost: temporal.your-domain.com
  tlsAdminEmail: you@your-domain.com
  tlsCertIssuer: letsencrypt-staging   # switch to letsencrypt-prod in the last step

  railsEnv: production
  secretKeyBase: <random-value>        # openssl rand -hex 64
  jwtSecret: <random-value>            # openssl rand -hex 64

  # Change these from the chart defaults before going to production
  dbPassword: <strong-password>
  temporalPostgresPassword: <strong-password>

lightningConfig:
  lightningHealthHost: lightning.your-domain.com

railsEnv, secretKeyBase, and jwtSecret are required even though the chart has defaults for them:

secretKeyBase: if it’s empty, the server and workers fail at startup.
jwtSecret: if it’s empty, the server signs sign-in tokens with a key that’s published in its source code.
railsEnv: the default, development, ignores your file storage settings and keeps uploads on the pod’s own disk. Email sending fails, and error pages show stack traces.

Generate secretKeyBase and jwtSecret once and keep them. Changing secretKeyBase later makes encrypted data unreadable, and changing jwtSecret signs everyone out.

See the Helm configuration reference for the other values you can set, such as SMTP, branding, and AI model endpoints.

Install the chart

helm repo add aisquared https://multiwoven.github.io/helm-charts
helm repo update
helm install aisquared aisquared/aisquared -f my-values.yaml

Don’t pass --namespace/--create-namespace. The chart creates the namespace in kubernetesNamespace itself and deploys everything there.

You can use any release name. With the release name aisquared, resources are named aisquared-server, aisquared-postgresql, and so on. Other release names give <release>-aisquared-server. The in-cluster addresses for PostgreSQL, Temporal, and Lightning are worked out from the release name automatically.

Point DNS at the ingress controller

Find the external IP address (or hostname) of the ingress controller. It can take a minute or two to appear.

kubectl get svc -n ingress-nginx ingress-nginx-controller

Create an A record (or a CNAME if your provider returns a hostname) for each hostname in Hostnames, pointing at that address. See your DNS provider’s documentation:

Verify the staging certificate

Run the following until the certificate shows Ready: True:

kubectl describe certificate -n aisquared mw-tls-cert

Then open https://app.your-domain.com. The browser will warn that the certificate is not trusted; this is expected for the Let’s Encrypt staging issuer. Confirm that the certificate was issued by (STAGING) Let's Encrypt.

Switch to the production certificate

Once everything works on the staging certificate, set platformConfig.tlsCertIssuer: letsencrypt-prod in my-values.yaml and upgrade:

helm upgrade aisquared aisquared/aisquared -f my-values.yaml

Repeat the previous step until a valid certificate is issued. Your deployment is ready at https://app.your-domain.com.

Let’s Encrypt’s production server enforces rate limits that can lock you out for up to a week after repeated failures. Only switch to letsencrypt-prod after the staging certificate has been issued successfully.

Temporal

By default the chart runs Temporal and the Temporal UI in the cluster (temporal.enabled: true). This is fine for development and evaluation. For production, we strongly recommend Temporal Cloud. To use Temporal Cloud:

Download your Temporal Cloud namespace’s client certificate and key, and create a secret named temporal-cloud in the platform namespace:
kubectl create secret generic temporal-cloud -n aisquared \ --from-file=temporal-root-cert=./temporal.pem \ --from-file=temporal-client-key=./temporal.key
The namespace exists only after the first helm install. If you’re configuring Temporal Cloud from the start, create the namespace with kubectl create namespace aisquared first.

Add the following to your values file:

temporal:
  enabled: false

platformConfig:
  temporalHost: <your-namespace>.tmprl.cloud
  temporalNamespace: <your-namespace>

platformConfig.temporalUiHost isn’t used when in-cluster Temporal is disabled.

Ingress options

Choose one ingress option:

Option	Values	TLS
NGINX (default)	`nginxIngress.enabled: true`	cert-manager + Let’s Encrypt (`platformConfig.tlsCertIssuer`)
AWS Application Load Balancer	`nginxIngress.enabled: false`, `awsIngress.enabled: true`	ACM certificate (`awsIngress.acmCertificateArn`)
Kong	`nginxIngress.enabled: false`, `kongIngress.enabled: true`	Configure in Kong

An ALB example:

nginxIngress:
  enabled: false

awsIngress:
  enabled: true
  acmCertificateArn: arn:aws:acm:<region>:<account-id>:certificate/<id>
  albScheme: internet-facing   # or internal
  groupName: ""                 # set to share one ALB across multiple Ingresses

The ALB option requires the AWS Load Balancer Controller in the cluster. Set externalDNS.enabled: true if you run ExternalDNS and want the DNS records created for you. To restrict access by source IP, set platformConfig.allowedSourceIP (NGINX only; default 0.0.0.0/0).

External databases

To use a managed PostgreSQL instance (for example Amazon RDS or Azure Database for PostgreSQL) instead of the in-cluster one:

postgresql:
  enabled: false

platformConfig:
  dbHost: <your-db-host>
  dbPort: "5432"
  dbUsername: <user>
  dbPassword: <password>
  dbName: aisquared_server_production

If the platform, Temporal, and Temporal visibility databases live on different hosts, set multipleDbHosts.enabled: true and fill in multipleDbHosts.platformDBHost, temporalDbHost, and temporalVisibilityDbHost (and the matching *Name keys).

Secrets

By default, the credentials in your values file (database passwords, API keys, SMTP passwords) are rendered into a ConfigMap. For production on AWS, the chart can load them from AWS Secrets Manager instead, through the Secrets Store CSI Driver.

How it works

Credentials are split into groups, and you turn each group on separately. For each group you turn on:

You create one JSON secret in AWS Secrets Manager holding that group’s keys.
The chart creates a SecretProviderClass that tells the CSI driver which JSON keys to read from that secret.
When a pod that uses the group starts, the driver fetches the secret. It copies the values into a Kubernetes Secret in the platform namespace. That Secret is named by the group’s alias.
The pods read their environment variables from that Kubernetes Secret. The matching plaintext keys are left out of the ConfigMap, and the values in your values file are ignored.

Groups that you leave off keep using the plaintext values from your values file.

Groups

Group	Toggle	Secrets Manager secret name	Kubernetes Secret (alias) and default	Used by
Platform database	`mwDbSecretEnabled`	`mwDbCredsSecretName`	`mwDbSecretAlias`: `mw-f01dd256e712`	server, worker, solid worker
Temporal database	`temporalDbSecretEnabled`	`temporalDbCredsSecretName`	`temporalDbSecretAlias`: `temporal-f01dd256e712`	Temporal
Temporal visibility database	`temporalDbSecretEnabled` (shared with Temporal database)	`temporalVisibilityDbCredsSecretName`	`temporalVisibilityDbSecretAlias`: `temporal-visibility-f01dd256e712`	Temporal
Temp store database	`tempStoreDbSecretEnabled`	`tempStoreDbCredsSecretName`	`tempStoreDbSecretAlias`: `temp-store-f01dd256e712`	server
Application	`appSecretEnabled`	`appCredsSecretName`	`appSecretAlias`: `aisquared-app-f01dd256e712`	server, worker, solid worker
Sandbox	`sandboxSecretEnabled`	`sandboxCredsSecretName`	`sandboxSecretAlias`: `aisquared-sandbox-f01dd256e712`	server, worker, solid worker
Lightning	`lightningSecretEnabled`	`lightningCredsSecretName`	`lightningSecretAlias`: `aisquared-lightning-f01dd256e712`	Lightning
Box	`boxSecretEnabled`	`boxCredsSecretName`	`boxSecretAlias`: `aisquared-box-f01dd256e712`	Box

All keys in the table are under secretsStore.

The alias is the name of the Kubernetes Secret the driver creates. The defaults work as they are. Change an alias only if the name would clash with an existing Secret in the namespace, for example when two releases share a namespace.

What to put in each secret

Each Secrets Manager secret is a JSON object. Every key listed for a group must be present, even if you don’t use that feature. Set unused keys to an empty string (""). If a key is missing, the CSI driver can’t mount the volume, and the pods using that group stay in ContainerCreating. The three database groups each use two short keys, u (username) and p (password):

{ "u": "aisquared", "p": "<password>" }

The other groups use the same key names as the matching values in values.yaml. For example, the application group’s smtpPassword replaces platformConfig.smtpPassword.

Application (appCredsSecretName)

Replaces the matching keys under platformConfig.

{
  "awsAccessKeyId": "",
  "awsSecretAccessKey": "",
  "appsignalPushApiKey": "",
  "boxApiKey": "",
  "codeExecSigningSecret": "",
  "hostedVectorDbUsername": "",
  "hostedVectorDbPassword": "",
  "hubspotApiKey": "",
  "jwtSecret": "",
  "maxmindLicenseKey": "",
  "neonApiKey": "",
  "newRelicKey": "",
  "openrouterApiKey": "",
  "p2wLlmApiKey": "",
  "prometheusMetricsUsername": "",
  "prometheusMetricsPassword": "",
  "promptToWorkflowApiKey": "",
  "secretKeyBase": "",
  "smtpUsername": "",
  "smtpPassword": "",
  "storageAccessKey": "",
  "textractAccessKeyId": "",
  "textractSecretAccessKey": ""
}

Sandbox (sandboxCredsSecretName)

Replaces the matching keys under sandboxConfig.

{
  "agenticCodingBuildToken": "",
  "codingAgentModelApiKey": "",
  "codingAgentOpenaiApiKey": "",
  "codingAgentXaiApiKey": "",
  "codingAgentGoogleApiKey": "",
  "modalTokenId": "",
  "modalTokenSecret": "",
  "dockerHubRegistryUsername": "",
  "dockerHubRegistryPassword": "",
  "agenticCodingGithubAppClientSecret": "",
  "agenticCodingGithubWebhookSecret": ""
}

Lightning (lightningCredsSecretName)

Replaces the matching keys under lightningConfig.

{
  "babelApiKey": "",
  "polyApiKey": "",
  "chatApiKey": "",
  "embeddingApiKey": "",
  "judyApiKey": "",
  "multimodalChatApiKey": "",
  "pathfinderApiKey": "",
  "seemoreApiKey": "",
  "sentinelApiKey": "",
  "structuredExtractionApiKey": "",
  "xpertApiKey": "",
  "clsPiiApiKey": "",
  "clsContentApiKey": "",
  "clsJailbreakApiKey": "",
  "clsRouterApiKey": ""
}

Box (boxCredsSecretName)

Replaces boxConfig.boxApiKey, boxConfig.boxEncryptionKey, boxConfig.dbUsername, boxConfig.dbPassword, and the coding-agent keys under sandboxConfig.

{
  "boxApiKey": "",
  "boxEncryptionKey": "",
  "codingAgentModelApiKey": "",
  "codingAgentOpenaiApiKey": "",
  "codingAgentXaiApiKey": "",
  "codingAgentGoogleApiKey": "",
  "dbUsername": "",
  "dbPassword": ""
}

The key lists above are for chart 0.118.0. To get the exact list for the chart version you’re installing, render that group’s SecretProviderClass and read the path: entries. Each path is a JSON key your secret must contain.

helm template aisquared aisquared/aisquared --version <chart-version> \
  --set secretsStore.appSecretEnabled=true \
  --set secretsStore.appCredsSecretName=placeholder \
  --show-only templates/secret-provider-class-app.yaml

Swap app for sandbox, lightning, box, mw, temporal, temporal-visibility, or temp-store (and the matching toggle and name values) to check the other groups.

Set it up

Install the CSI driver and the AWS provider

Install these once per cluster. syncSecret.enabled=true is required: without it the driver never creates the Kubernetes Secrets, and the pods fail to start.

helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver \
  --namespace kube-system \
  --set syncSecret.enabled=true \
  --set enableSecretRotation=true \
  --set rotationPollInterval=2m

helm repo add aws-secrets-manager https://aws.github.io/secrets-store-csi-driver-provider-aws
helm install secrets-provider-aws aws-secrets-manager/secrets-store-csi-driver-provider-aws \
  --namespace kube-system

(Optional) Install Reloader. The chart already adds Reloader annotations to its deployments, so when a rotated value reaches the Kubernetes Secret, the pods using it restart automatically. Without Reloader, restart the pods yourself after rotating a secret.

Create the secrets in AWS Secrets Manager

Create one secret for each group you’re turning on. Prefix the names with the environment, such as prod-aisquared/app, so you can scope IAM to that prefix and keep environments apart:

aws secretsmanager create-secret --name prod-aisquared/app --secret-string file://app.json
aws secretsmanager create-secret --name prod-aisquared/platform-db --secret-string '{"u":"aisquared","p":"<password>"}'

Use file:// for anything with real values, so the secrets don’t end up in your shell history.

Grant the pods read access

Create an IAM role that the platform’s service account can assume through IRSA, with this policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
    "Resource": "arn:aws:secretsmanager:<region>:<account-id>:secret:prod-aisquared/*"
  }]
}

If the secrets are encrypted with a customer-managed KMS key, also allow kms:Decrypt on that key.Box uses its own service account. To use the Box group, give Box a separate role through box.serviceAccount.annotations.

Configure the chart

serviceAccount:
  create: true
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>

secretsStore:
  secretRegion: us-east-1

  mwDbSecretEnabled: true
  mwDbCredsSecretName: prod-aisquared/platform-db

  temporalDbSecretEnabled: true
  temporalDbCredsSecretName: prod-aisquared/temporal-db
  temporalVisibilityDbCredsSecretName: prod-aisquared/temporal-visibility-db

  appSecretEnabled: true
  appCredsSecretName: prod-aisquared/app

  lightningSecretEnabled: true
  lightningCredsSecretName: prod-aisquared/lightning

secretRegion must match the region the secrets are in. Enabling a group without its *CredsSecretName makes the install fail with an error naming the missing value.

Verify

After installing or upgrading, check that the driver created the Kubernetes Secrets:

kubectl get secrets -n aisquared | grep f01dd256e712

If a pod is stuck in ContainerCreating, look at its events:

kubectl describe pod -n aisquared <pod-name>

The usual causes are:

AccessDenied: the IAM role or policy doesn’t cover the secret name, or the service account annotation is missing.
A JMES path error: the secret is missing one of the group’s keys.
Failed to fetch secret from all regions: secretRegion is wrong.

App Builder

App Builder (called agentic coding in the chart and the code) lets users build apps by chatting with a coding agent. Self-hosting it involves three pieces:

Piece	What it does	Configured with
Coding agent	OpenCode, running inside each sandbox, calls the LLM you choose.	`sandboxConfig.codingAgent*`
Sandbox runtime	Runs each App Builder session’s code and preview.	`sandboxConfig.agenticCodingSandboxProvider`: `modal` (default) or `box`
Published apps	Serves finished apps at `<app>.<published-domain>`.	`appbuilderIngress`

Sandboxes run on Modal by default, so App Builder works without extra cluster setup once you add a Modal token. Choose Box if the generated code must stay inside your own cluster.

Coding agent

sandboxConfig:
  codingAgentProvider: opencode                      # the only provider today
  codingAgentModel: anthropic/claude-sonnet-5        # <provider>/<model>
  codingAgentModelApiKey: <api-key-for-that-provider>

Choosing the provider: the prefix of codingAgentModel selects it, for example anthropic/, openai/, google/, groq/ or amazon-bedrock/.
API key: codingAgentModelApiKey is the key for that provider. It’s required when the sandbox runtime is Box.
Amazon Bedrock: set codingAgentModel to an amazon-bedrock/... value and codingAgentBedrockModelId to your Bedrock inference profile. Bedrock uses AWS credentials from the pod instead of an API key.

sandboxConfig:
  agenticCodingSandboxProvider: modal
  modalTokenId: <token-id>
  modalTokenSecret: <token-secret>
  modalEnvironment: main
  agenticCodingSandboxDomain: sandbox.your-domain.com   # custom domain for sandbox preview URLs
  # Only needed if the sandbox base image is private on Docker Hub
  dockerHubRegistryUsername: <user>
  dockerHubRegistryPassword: <token>

Sandbox runtime: Box (in your cluster)

Box is a small service that creates sandbox pods in your cluster. It gives each one a persistent volume and an ingress URL, snapshots idle sandboxes, and promotes finished apps to long-running releases. Cluster requirements

The VolumeSnapshot CRDs and snapshot-controller.
A CSI storage driver that supports snapshots, with a VolumeSnapshotClass matching boxConfig.boxSnapshotClass.
A StorageClass matching boxConfig.boxStorageClass.
An ingress controller (boxConfig.boxIngressClass, in boxConfig.boxIngressNamespace).
A wildcard DNS record *.<boxIngressDomain> pointing at that ingress controller.
A PostgreSQL database for Box’s own state.

box:
  enabled: true

platformConfig:
  boxBaseUrl: http://aisquared-box:8080      # <release-fullname>-box
  boxApiKey: <same-value-as-boxConfig.boxApiKey>

sandboxConfig:
  agenticCodingSandboxProvider: box
  agenticCodingSandboxImage: multiwoven/ai-appgen-sandbox:latest
  codingAgentModelApiKey: <api-key>

boxConfig:
  boxApiKey: <random-string>                # openssl rand -hex 32
  boxEncryptionKey: <64-hex-characters>     # openssl rand -hex 32
  boxIngressDomain: sandbox.your-domain.com
  boxStorageClass: <storage-class>
  boxSnapshotClass: <volume-snapshot-class>
  dbHost: <postgres-host>
  dbUsername: <user>
  dbPassword: <password>
  boxDbName: box_production

API key: platformConfig.boxApiKey (used by the platform) and boxConfig.boxApiKey (checked by Box) must be the same value.
Encryption key: boxEncryptionKey must be exactly 64 hex characters. It encrypts the secrets Box stores, so keep it stable; changing it makes existing sandbox secrets unreadable.
Namespaces and permissions: the chart creates the box-sandboxes namespace (boxConfig.boxK8sNamespace), a ClusterRole, a RoleBinding in that namespace, and the box-critical PriorityClass. Box runs under its own service account. For AWS access, give it a role through box.serviceAccount.annotations; it doesn’t share the platform’s role.
Restricted clusters: where you can’t create namespaces or RBAC (for example GovCloud), set box.namespaces.create: false and box.rbac.create: false, and have a cluster admin create them.

The chart doesn’t yet create the releases namespace (boxConfig.boxReleasesNamespace, default box-releases) or the Box permissions inside it, and Box doesn’t create it either. Until it does, published apps can’t be released. Create both yourself after installing (shown here for a release named aisquared in the aisquared namespace):

kubectl create namespace box-releases
kubectl create rolebinding aisquared-box-controller -n box-releases \
  --clusterrole=aisquared-box-controller \
  --serviceaccount=aisquared:aisquared-box-controller

Storage and databases for generated apps

Apps that users build can get their own file storage and Postgres database:

Value	Options	Notes
`sandboxConfig.agenticCodingStorageProvider`	`aws`, `none`	With `aws`, each app gets scoped S3 credentials. Set `agenticCodingS3Bucket`, `agenticCodingS3Region`, and `agenticCodingStsRoleName` (an IAM role name the server’s role can assume).
`sandboxConfig.agenticCodingDbProvider`	`neon`, `none`	With `neon`, each app gets a Neon database. Set `platformConfig.neonApiKey` (and optionally `neonDefaultRegion`).

Set either to none to turn that capability off.

Storage for generated apps needs release 0.126.0 or later. On earlier releases, storage in published apps stops working when its credentials expire (12 hours by default), because published apps can’t refresh them. With IRSA on releases before 0.124.0, storage can’t be turned on at all. On earlier releases, set sandboxConfig.agenticCodingStorageProvider: none.

The storage role (agenticCodingStsRoleName) needs:

A trust policy for the cluster’s OIDC provider. From 0.124.0, the platform assumes the role with its IRSA web identity token. If you use static AWS keys instead of IRSA, trust the IAM principal those keys belong to.
A MaxSessionDuration of at least agenticCodingStsDuration. That’s 12 hours by default; AWS’s own default is 1 hour.

Published apps

Published apps are served at <app-label>.<appgenPublishedDomain> and proxied through the platform API. To turn this on:

appbuilderIngress:
  enabled: true
  appgenPublishedDomain: apps.your-domain.com
  tlsSecretName: appbuilder-wildcard-tls

Create a wildcard DNS record, *.apps.your-domain.com, pointing at your ingress controller.
Provide a wildcard TLS certificate.
- NGINX: the HTTP-01 issuers this chart creates can’t issue wildcard certificates. Create the tlsSecretName secret in the platform namespace yourself, or issue it with a cert-manager DNS-01 issuer.
- ALB: cover the wildcard in your ACM certificate. Leave appbuilderIngress.groupOrder higher than awsIngress.groupOrder, so that exact hostnames are matched before the wildcard.

GitHub integration (optional)

This lets users push App Builder apps to GitHub repositories.

Create a GitHub App.

Create a Kubernetes secret from its private key:

kubectl create secret generic agentic-coding-github-app-key -n aisquared \
  --from-file=private-key.pem=./github-app.pem

Configure the chart:

sandboxConfig:
  agenticCodingGithubAppSlug: <app-slug>
  agenticCodingGithubAppId: "<app-id>"
  agenticCodingGithubAppClientId: <client-id>
  agenticCodingGithubAppClientSecret: <client-secret>
  agenticCodingGithubWebhookSecret: <webhook-secret>
  agenticCodingGithubAppPrivateKeyPath: agentic-coding-github-app-key   # the secret's name
  agenticCodingGithubBotName: AppBuilder Bot
  agenticCodingGithubBotEmail: appbuilder-bot@your-domain.com

agenticCodingGithubAppPrivateKeyPath takes the name of the Kubernetes secret, not a file path. The chart mounts the secret and points the app at the key file.

Sandbox sizing and lifecycle

Value	Unit	Purpose
`agenticCodingSandboxCpu` / `agenticCodingSandboxMemory`	millicores / MB	Resources for each session’s sandbox
`agenticCodingSandboxTimeout`	seconds	Maximum sandbox lifetime
`agenticCodingSandboxIdleTimeout`	seconds	Idle time before a sandbox stops
`agenticCodingIdleThreshold`	minutes	Inactivity before a session is snapshotted and suspended
`agenticCodingSnapshotInterval`	cron	How often the snapshot-and-suspend job runs
`agenticCodingDeployCpu` / `agenticCodingDeployMemory`	millicores / MB	Resources for deployed apps (Modal only; Box uses `boxConfig.boxRelease*`)

All of these are under sandboxConfig. For per-value details and the Box resource settings, see the configuration reference.

Some App Builder feature toggles, such as AGENTIC_CODING_CUSTOM_TOOLS_ENABLED and AGENTIC_CODING_SECURITY_SCAN_ENABLED, aren’t exposed as chart values yet. They default to on.

Private image registry

To pull images from a private registry, create a docker-registry secret in the platform namespace and set:

platformConfig:
  privateRepo: true
  registrySecretName: <secret-name>   # default: mwregistrysecret

Set each component’s image under <component>.<component>.image, for example server.server.image.repository and server.server.image.tag.

Upgrading

helm repo update
helm upgrade aisquared aisquared/aisquared -f my-values.yaml

The in-cluster PostgreSQL volume is annotated with helm.sh/resource-policy: keep, so Helm never deletes it on upgrade or uninstall.

helm uninstall deletes the platform namespace, because the chart creates it. That includes anything you created in it by hand, such as the temporal-cloud secret, image pull secrets, and TLS secrets. The PostgreSQL PersistentVolumeClaim is kept. Delete it manually if you want to remove the data.

Upgrading from the multiwoven chart

The chart was renamed from multiwoven to aisquared in 0.117.0, and its values keys were renamed. Version 0.118.0 also changed several defaults. To upgrade an existing installation in place:

Keep your resource names

Set nameOverride: multiwoven. Without it, every resource is recreated under a new name.

Rename your values keys

The chart fails with a message naming the new key if an old one is used, including with --reuse-values.

Old key	New key
`multiwovenConfig`	`platformConfig`
`multiwovenServer.multiwovenServer`	`server.server`
`multiwovenUI.multiwovenUI`	`ui.ui`
`multiwovenWorker.multiwovenWorker`	`worker.worker`
`multiwovenSolidWorker.multiwovenSolidWorker`	`solidWorker.solidWorker`
`multiwovenPostgresql.multiwovenPostgresql`	`postgresql.postgresql`
`hpa.multiwoven{Server,UI,Worker,SolidWorker}`	`hpa.{server,ui,worker,solidWorker}`
`multipleDbHosts.multiwovenDB{Host,Name}`	`multipleDbHosts.platformDB{Host,Name}`

Pin the old defaults you relied on

If your install used any of these defaults, set the old value explicitly:

nameOverride: multiwoven
kubernetesNamespace: multiwoven
serviceAccount:
  name: multiwoven-service-account
platformConfig:
  dbUsername: multiwoven
  dbName: multiwoven_server_production
  temporalPostgresUser: multiwoven
  temporalNamespace: multiwoven-dev

Upgrade

Keep your existing release name:

helm repo update
helm upgrade multiwoven aisquared/aisquared -f my-values.yaml

Configuration reference

Every chart value, the environment variable it sets, its default, and the secret group it belongs to are listed in the Helm configuration reference. The chart’s values.yaml is the source of truth for the version you’re installing.

Deployment & Security

Deployment

Authentication & Access Control

Data Security & Infrastructure

Compliance & Certifications

What gets deployed

Prerequisites

Hostnames

Install

Temporal

Ingress options

External databases

Secrets

How it works

Groups

What to put in each secret

Set it up

App Builder

Coding agent

Sandbox runtime: Box (in your cluster)

Storage and databases for generated apps

Published apps

GitHub integration (optional)

Sandbox sizing and lifecycle

Private image registry

Upgrading

Upgrading from the multiwoven chart

Configuration reference

​What gets deployed

​Prerequisites

​Hostnames

​Install

​Temporal

​Ingress options

​External databases

​Secrets

​How it works

​Groups

​What to put in each secret

​Set it up

​App Builder

​Coding agent

​Sandbox runtime: Modal (default)

​Sandbox runtime: Box (in your cluster)

​Storage and databases for generated apps

​Published apps

​GitHub integration (optional)

​Sandbox sizing and lifecycle

​Private image registry

​Upgrading

​Upgrading from the multiwoven chart

​Configuration reference

What gets deployed

Prerequisites

Hostnames

Install

Temporal

Ingress options

External databases

Secrets

How it works

Groups

What to put in each secret

Set it up

App Builder

Coding agent

Sandbox runtime: Modal (default)

Sandbox runtime: Box (in your cluster)

Storage and databases for generated apps

Published apps

GitHub integration (optional)

Sandbox sizing and lifecycle

Private image registry

Upgrading

Upgrading from the multiwoven chart

Configuration reference