Helm guide

Moyai on-prem · 3 November 2026

For sites that install with plain Helm. Charts sit next to the images:

oci://registry.ankra.cloud/org-f9c93374-f280-4cbd-bb46-56458301b9ef/easterisland · oci://registry.ankra.cloud/org-f9c93374-f280-4cbd-bb46-56458301b9ef/moyai-harbor

Connected site

export CHART=oci://registry.ankra.cloud/org-f9c93374-f280-4cbd-bb46-56458301b9ef
export VERSION=<release from Moyai>

helm upgrade --install easterisland "$CHART/easterisland" --version "$VERSION" \
  --namespace easterisland-system -f easterisland-values.yaml --wait
helm upgrade --install moyai-harbor "$CHART/moyai-harbor" --version "$VERSION" \
  --namespace moyai-harbor-system -f moyai-harbor-values.yaml --wait

Upgrade by changing VERSION. Take a database backup first: a Helm rollback does not undo schema migrations.

Air-gapped site

Mirror one release on a machine that can reach both sides (or carry the archives across), then install from the site's own registry.

# Outside, logged in with the robot
helm pull "$CHART/easterisland" --version "$VERSION"
skopeo copy --all docker://registry.ankra.cloud/org-f9c93374-f280-4cbd-bb46-56458301b9ef/easterisland:<sha-tag> \
  oci-archive:easterisland-<sha-tag>.tar

# Inside
skopeo copy --all oci-archive:easterisland-<sha-tag>.tar \
  docker://registry.site.local/moyai/easterisland:<sha-tag>
helm push easterisland-$VERSION.tgz oci://registry.site.local/moyai
helm upgrade --install easterisland oci://registry.site.local/moyai/easterisland \
  --version "$VERSION" -f easterisland-values.yaml    # image values point at registry.site.local

Repeat for moyai-harbor and for the dependency images in the release's image list.

Moyai: publish the chart

One stage in .ankra/pipeline.yaml, using the organisation's own registry login:

secrets:
  - name: registry_login
    from: registry
stages:
  - name: publish-chart
    image: alpine/helm:3.16.3
    network: egress-https
    secrets: ["registry_login"]
    run: |
      helm package charts/easterisland --destination /tmp
      helm push /tmp/easterisland-*.tgz "oci://registry.ankra.cloud/org-${ANKRA_ORGANISATION_ID}" \
        --registry-config /run/agent-secrets/registry_login

Set the chart's appVersion to the run's sha- tag, never overwrite a version, and run migrations as a pre-upgrade hook.