Deploy with Helm

The operator installs its own CRDs at startup, so a plain Helm install is enough — no separate CRD apply.

Install

helm install mirops oci://ghcr.io/miropshq/charts/mirops \
  --namespace mirops --create-namespace --version 0.1.0

kubectl -n mirops rollout status deploy/mirops-controller-manager

Namespace — one knob

Let Helm create the namespace with --create-namespace. That's the only namespace setting you need, and it works for every case (including compatMatrix, whose pre-install hook needs the namespace to exist first). The chart doesn't create the namespace itself by default (namespace.create=false), so nothing collides.

Install with Terraform

The same install with the helm provider. create_namespace is the Terraform equivalent of --create-namespace — it creates the namespace before the pre-install hook, so it's the single namespace knob here too. Any --set becomes a set block.

resource "helm_release" "mirops" {
  name       = "mirops"
  repository = "oci://ghcr.io/miropshq/charts"
  chart      = "mirops"
  version    = "0.1.0"

  namespace        = "mirops"
  create_namespace = true   # == --create-namespace (the only namespace setting you need)

  # Optional add-ons — each is one `--set`:

  # Compatibility matrix (pin a date in production)
  set {
    name  = "compatMatrix.enabled"
    value = "true"
  }
  set {
    name  = "compatMatrix.version"
    value = "v2026.09.03"
  }

  # Azure Blob via Workload Identity — dots in the key are escaped with \\,
  # and --set-string maps to type = "string"
  set {
    name  = "podLabels.azure\\.workload\\.identity/use"
    value = "true"
    type  = "string"
  }
  set {
    name  = "serviceAccount.annotations.azure\\.workload\\.identity/client-id"
    value = "<client-id>"
  }
}

helm provider v3

The block form above is hashicorp/helm v2. On v3, set is a list attribute instead: set = [{ name = "compatMatrix.enabled", value = "true" }, ...].

Cloud credentials (for remote reports)

Skip this if you write reports to a local file or a pvc.

AWS S3 via IRSA:

helm install mirops oci://ghcr.io/miropshq/charts/mirops \
  --namespace mirops --create-namespace \
  --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::<acct>:role/mirops-s3-role

Azure Blob via Workload Identity:

helm install mirops oci://ghcr.io/miropshq/charts/mirops \
  --namespace mirops --create-namespace \
  --set-string podLabels."azure\.workload\.identity/use"=true \
  --set serviceAccount.annotations."azure\.workload\.identity/client-id"=<client-id>

The tenant-id is optional — Workload Identity uses the cluster's default OIDC tenant. Set it only for cross-tenant identities: --set serviceAccount.annotations."azure\.workload\.identity/tenant-id"=<tenant-id>.

Persistent report storage (PVC)

helm install mirops oci://ghcr.io/miropshq/charts/mirops \
  --namespace mirops --create-namespace \
  --set reportPVC.enabled=true

Then set spec.source.type: pvc on your analyses.

Compatibility matrix version (optional)

By default the operator uses its embedded matrix. To update it without rebuilding the operator, pull a published version into the override ConfigMap:

# newest (non-prod)
helm upgrade --install mirops oci://ghcr.io/miropshq/charts/mirops \
  --namespace mirops --create-namespace \
  --set compatMatrix.enabled=true --set compatMatrix.version=latest

# pinned date (reproducible; production)
helm upgrade --install mirops oci://ghcr.io/miropshq/charts/mirops \
  --namespace mirops --create-namespace \
  --set compatMatrix.enabled=true --set compatMatrix.version=v2026.09.03

The pull runs as a pre-install hook (before the chart's normal resources), so the namespace must already exist — --create-namespace lets Helm create it first. See the compatibility matrix for details.

Verify

kubectl -n mirops get pods
kubectl -n mirops logs deploy/mirops-controller-manager

Upgrade & uninstall

helm upgrade mirops oci://ghcr.io/miropshq/charts/mirops --namespace mirops
helm uninstall mirops --namespace mirops

Next

Create your first analysis, or configure AI scoring.