Helm Chart

Deploy Spice.ai Enterprise on Kubernetes with the official Helm chart.

The Spice.ai Enterprise Helm chart deploys the Spice runtime as a Kubernetes Deployment or StatefulSet with a ConfigMap-mounted Spicepod configuration.

Install

The chart is published to the AWS Marketplace ECR registry, one chart per image variant, with the image pre-configured. Subscribe to the Enterprise listing first (see AWS Marketplace), then authenticate Helm against the registry:

aws ecr get-login-password --region us-east-1 \
  | helm registry login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com

The login is valid for 12 hours; re-run it when the token expires.

helm install spiceai \
  oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/spice-ai/spiceai-enterprise-byol \
  --version 2.4.1-enterprise-models-helm \
  --set spicepod.name=my-app

Values Reference

Parameter	Description	Default
`image.repository`	Container image repository	`709825985650.dkr.ecr.us-east-1.amazonaws.com/spice-ai/spiceai-enterprise-byol`
`image.tag`	Container image tag	The chart variant's image tag, such as `2.4.1-enterprise-models`
`replicaCount`	Number of replicas	`1`
`strategy`	Update strategy for the `Deployment`	None (Kubernetes default)
`updateStrategy`	Update strategy for the `StatefulSet`	None (Kubernetes default)
`serviceAccount.create`	Create a `ServiceAccount`	`false`
`serviceAccount.name`	`ServiceAccount` name	None
`serviceAccount.annotations`	Annotations for the `ServiceAccount`	`{}`
`service.type`	Kubernetes Service type	None
`service.additionalAnnotations`	Annotations for the Service	`{}`
`stateful.enabled`	Use a `StatefulSet` with PVC	`false`
`stateful.storageClass`	`StorageClass` for `StatefulSet` PVC	`standard`
`stateful.size`	PVC size	`1Gi`
`stateful.mountPath`	Mount path in container	`/data`
`monitoring.podMonitor.enabled`	Create a `PodMonitor` for Prometheus	`false`
`monitoring.podMonitor.additionalLabels`	Labels for the `PodMonitor`	`{}`
`additionalLabels`	Labels added to all resources	`{}`
`additionalEnv`	Extra environment variables	`[]`
`resources`	CPU/memory requests and limits	`{}`
`volumes`	Additional volumes	`[]`
`volumeMounts`	Additional volume mounts	`[]`
`spicepod`	Spicepod configuration (inlined into `ConfigMap`)	None

Spicepod Configuration

The Spicepod spec is inlined directly in the Helm values and mounted as a ConfigMap:

spicepod:
  name: my-app
  version: v1
  kind: Spicepod
  datasets:
    - from: s3://my-bucket/data/
      name: my_data
      params:
        file_format: parquet
      acceleration:
        enabled: true
        engine: duckdb

StatefulSet with Persistent Storage

Enable a StatefulSet with a PersistentVolumeClaim for durable storage:

stateful:
  enabled: true
  storageClass: gp3
  size: 50Gi
  mountPath: /data

Update Strategy

Both keys are unset by default, so Kubernetes applies its own default strategy. Which one the chart reads depends on stateful.enabled.

With stateful.enabled: false the chart renders a Deployment and reads strategy:

strategy:
  type: Recreate

With stateful.enabled: true the chart renders a StatefulSet and reads updateStrategy:

updateStrategy:
  type: RollingUpdate

The key that does not match stateful.enabled is ignored, so setting strategy on a StatefulSet deployment has no effect. Each value is passed through to the workload spec unchanged, so any field the Kubernetes strategy type accepts (for example rollingUpdate.maxUnavailable or rollingUpdate.partition) can be set alongside type.

Resource Limits

resources:
  requests:
    cpu: 200m
    memory: 1Gi
  limits:
    cpu: "2"
    memory: 4Gi

Prometheus Monitoring

monitoring:
  podMonitor:
    enabled: true
    additionalLabels:
      release: prometheus

ServiceAccount for Cloud IAM

AWS IRSA (EKS)

serviceAccount:
  create: true
  name: spiceai
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/my-spice-role

See AWS IRSA for full setup instructions.

GKE Workload Identity

serviceAccount:
  create: true
  annotations:
    iam.gke.io/gcp-service-account: my-gcp-sa@my-project.iam.gserviceaccount.com

Azure Workload Identity (AKS)

serviceAccount:
  create: true
  annotations:
    azure.workload.identity/client-id: <AZURE_CLIENT_ID>