Appian Platform (CS) Helm Chart

A Helm chart for deploying the Appian platform on Kubernetes. This Helm chart is supplied by Appian Customer Success via the Appian App Market.

This chart deploys a custom resource of type appian that is managed by the Appian Operator.

Introduction

This chart facilitates the deployment of Appian sites through templated support for common options while baking-in best practice configurations.

Prerequisites

• Deployment prerequisites

• Appian operator

The Config Generator tool from Appian Kubernetes Utilities, available from the Appian App Market, can help you prepare these prerequisites.

Usage

Review templated custom resource specification

Want to see what custom resource specification your values file would produce? You can preview your Appian custom resource manifest by preparing your values file and running the following:

helm template -f values.yaml appian-platform-cs-$CHART_VERSION.tgz > appian-site.yaml

Note: You need to substitute the placeholder CHART_VERSION with the version of chart you are using. A YAML file that specifies the values for the parameters must be provided (e.g. values.yaml).

Or if you have already deployed the chart to your Helm repository:

xxxxxxxxxx
helm template -f values.yaml oci://$REGISTRY_NAME/$REPOSITORY_NAME/appian-platform-cs --version $CHART_VERSION > appian-site.yaml

Note: You need to substitute the placeholders REGISTRY_NAME and REPOSITORY_NAME with a reference to your Helm chart registry and repository. A YAML file that specifies the values for the parameters must be provided (e.g. values.yaml).

Deploying or restarting the Appian site (Installing the chart)

To install the chart with the release name $SITE_NAME:

xxxxxxxxxx
helm install $SITE_NAME --namespace appian -f values.yaml --wait oci://$REGISTRY_NAME/$REPOSITORY_NAME/appian-platform-cs --version $CHART_VERSION

Note: You need to substitute the placeholders REGISTRY_NAME and REPOSITORY_NAME with a reference to your Helm chart registry and repository. A YAML file that specifies the values for the parameters must be provided (e.g. values.yaml) while installing the chart.

Stopping the Appian site (Deleting the chart)

To stop the Appian site with the release name $SITE_NAME:

xxxxxxxxxx
helm uninstall $SITE_NAME --namespace appian

This will not delete the Persistent Volume Claims nor the associated RDBMS and as such leaves the site's data in place ready for when the site is next started again.

Upgrading or hotfixing the Appian site

To upgrade the Appian site to a new major version, or to hoftix the site with newer container images for the same major version:

1. Stop the Appian site (Ensure the site stops cleanly with all checkpoints completed).

2. Update the value of url in your values file to reference your new target version

3. Start the Appian site

Ensure you check the operator release notes and platform release notes before upgrading an Appian site and provision the relevant container images and Operator Helm chart in your container registry.

Upgrading this Helm chart

To upgrade to a later version of this Helm chart, ensure you check the Release Notes for any changes. Before upgrading, use the helm template command to compare the output generated by the new version of the chart with your existing configuration.

Example values files

This section provides some sample values files illustrating certain configuration options.

Note: These few examples are not exhaustive and do not represent all possible configurations.

Example 1 - Non-HA, MariaDB, AWS Load Balancer

Spec overview:

• Non-HA

• class "small"

• MariaDB primary data source

• AWS Load Balancer ingress, with SSL configured via an AWS certificate

• Container registry authenticated via images.pullSecrets

xxxxxxxxxx
siteName: company-proj-dev
version: "24.3.100.0"
url: https://proj-dev.company.com
staticUrl: https://proj-dev.company-static.com
dynamicUrl: https://proj-dev.company-dynamic.com
class: small
# Non-HA
highAvailability: false
passwordsPropertiesSecretName: "passwords-properties"
license:
  k3SecretName: "k3lic"
  k4SecretName: "k4lic"
  appianConfigMapName: "appian-lic"
storage:
  rwoStorageClassName: "my-ebs-sc"
  sharedLogsPvc: "appian-shared-logs-pvc"
images:
  pullSecrets:
    - regcred
  appian:
    repository: "my.container.registry.com/appian"
  minimal:
    repository: alpine
    tag: "3.18.0"
smtp:
  senderAddress: "my_from_address@my_domain.com"
  senderDomain: "my_domain.com"
  host: "my.smtp.server.smtp.com"
  auth: true
  user: "my_user_name"
  protocol: "smtp"
  starttlsEnabled: false
  starttlsRequired: false
dataSources:
  # MariaDB primary data source
  primary:
    name: jdbc/AppianPrimary
    dbType: mariadb
    dbServerAndPort: my.database.server.com:3306
    schemaName: "appian_primary"
    usernameSecretKeyRef:
      name: "appian-primary-ds"
      key: "username"
    passwordSecretKeyRef:
      name: "appian-primary-ds"
      key: "password"
ingressTemplate:
  # AWS Load Balancer ingress
  name: alb
  # SSL configured via an AWS certificate
  certificateReference: "my-cert-arn"

Example 2 - HA, MySQL, NGINX

Spec overview:

• HA

• class "medium"

• MySQL primary and one business data source

• NGINX ingress, with SSL configured via TLS field

• Node selector targeting dedicated Appian node group

• Kafka storage size (set by class template) overridden

• Data Service class upscaled to "large"

• Self-managed monitoring metrics API enabled

xxxxxxxxxx
siteName: company-proj-dev
version: "24.3.100.0"
url: https://proj-dev.company.com
staticUrl: https://proj-dev.company-static.com
dynamicUrl: https://proj-dev.company-dynamic.com
class: medium
# HA
highAvailability: true
passwordsPropertiesSecretName: "passwords-properties"
# Self-Managed Monitoring Metrics API
metricsAuthToken: "bW9uaXRvcmluZw=="
# Node selector targeting dedicated Appian node group
nodeSelector:
  my-node-group-label-key: my-node-group-label-value
license:
  k3SecretName: "k3lic"
  k4SecretName: "k4lic"
  appianConfigMapName: "appian-lic"
storage:
  rwoStorageClassName: "my-rwo-sc"
  sharedLogsPvc: "appian-shared-logs-pvc"
  haSharedDataPvc: "appian-shared-data-pvc"
images:
  appian:
    repository: "my.container.registry.com/appian"
  minimal:
    repository: alpine
    tag: "3.18.0"
smtp:
  senderAddress: "my_from_address@my_domain.com"
  senderDomain: "my_domain.com"
  host: "my.smtp.server.smtp.com"
  auth: true
  user: "my_user_name"
  protocol: "smtp"
  starttlsEnabled: false
  starttlsRequired: false
dataSources:
  # MySQL primary
  primary:
    name: jdbc/AppianPrimary
    dbType: mysql
    dbServerAndPort: my.database.server.com:3306
    schemaName: "appian_primary"
    usernameSecretKeyRef:
      name: "appian-primary-ds"
      key: "username"
    passwordSecretKeyRef:
      name: "password-secret-appian-primary-ds"
      key: "password"
  # one business data source
  business:
    - name: jdbc/Appian
      dbType: mysql
      dbServerAndPort: my.database.server.com:3306
      schemaName: "appian"
      usernameSecretKeyRef:
    name: "appian-business-ds"
        key: "username"
      passwordSecretKeyRef:
        name: "appian-business-ds"
        key: "password"
ingressTemplate:
  # NGINX ingress
  name: nginx
  # SSL configured via TLS field
  tls:
    - hosts:
        - proj-dev.company.com
        - proj-dev.company-static.com
        - proj-dev.company-dynamic.com
      secretName: appian-ingress-tls-secret
# Kafka storage size (set by class template) overridden
kafka:
  storageSize: "60Gi"
dataServer:
  class: "large"

Limitations

A number of fields in the Custom Resource are immutable. These must not be modified for a running site, so any Helm upgrades to the chart must avoid changing these values. To be able to change these immutable fields, the Appian site needs to be stopped (by deleting the chart) and restarted (by installing the chart with updated values).

As version is one of these immutable fields, Appian hotfixes and major version upgrades cannot be applied using helm upgrade and require the site to be stopped and restarted as above.

T-Shirt Sizing

This Helm chart uses a class parameter to apply default values for a range of size- and scaling-related parameters, which can then be fine-tuned using component-level overrides. An appropriate t-shirt size should be chosen as a starting configuration. Performance testing should be used to determine whether to change class or, alternatively, to override certain parameters set by class templates.

For example, a site with higher process throughput may require larger Kafka storage and additional resources for just the execution engines - which can be achieved by overriding just those parameters, while all other relevant parameters are left as set by the chosen class.

The table below provides very rough guidelines for each class, including the expected resources required to run each size.

Assumes 3 Exec/Analytics shards without RPA or AI. Initial sizing only. Performance testing / observation and resource request / compute right-sizing is required.

Parameters

General parameters

License parameters

Storage parameters

Images parameters

SMTP parameters

Data Sources parameters

The datasources field allows primary and business data sources to be configured with ease via built-in templates for each supported RDBMS.

Data Source Template parameters

The following parameters are available for dataSources.primary and for each item in the list dataSources.business. The chart's Data Source Templates make it simpler to apply the correct configurations for each data source with fewer, simpler parameters to be configured.

Ingress Template parameters

The ingressTemplate field allows an ingress to be configured with ease via built-in templates for 4 popular ingress controllers: NGINX Ingress Controller, AWS Load Balancer Controller, Azure Application Gateway Ingress Controller (AGIC) and OpenShift Default ingress controller. These templates apply standard annotations required for each ingress class.

If you are using another ingress controller, configure this using Ingress instead.

Replication parameters

The replication parameters enable a site to be configured for Kafka real-time transaction replication via MirrorMaker for Kafka mirroring. The site can be configured either as a replication source or destination using these parameters.

Per-Component overrides and additional parameters

Overrides for fields set automatically based on general parameters (e.g. via class) and additional optional parameters can be specified at component-level.

Zookeeper

Kafka

Search Server

Data Service

Note that the Data Service object is called dataServer in the Appian CRD.

Service Manager

Webapp

Httpd

MirrorMaker

Common Additional Parameters

The following optional parameters can be specified for any component listed above.

Custom Logger

The following parameters are available for each item in the list webapp.customLoggers. The chart's Custom Logger Template makes it simpler to customize application logging. Logging for these custom loggers will be output in the root ~/logs directory of each pod and named {reference}.log. Log rotation is enabled within the settings output in the ConfigMap generated by this chart.

Service

By default, a service is configured by the chart with spec.service.type: ClusterIP. Configure this service object for any alternative service configurations.

Ingress

Ingress for ingress controllers NGINX Ingress Controller, AWS Load Balancer Controller and Azure Application Gateway Ingress Controller (AGIC) can be configured via ingressTemplate. For any other ingress controller, use ingress below.

RPA

RPA can be configured for the Appian site via the rpa component. No pre-configured options are included in this Helm chart for RPA at this time. See the sample YAML file, the Custom Resource Definition and the RPA Setup section for RPA configuration options.

Managed Custom Properties

The following custom properties are automatically added based on either default configurations, class or driven by values file fields.

Excluded Appian CRD Fields

The following fields from the Appian CRD either cannot be set via this Helm chart, or the value that this Helm chart configures cannot be directly overridden. If you must customise one of these fields, this can be done in the site YAML directly after generating it via helm template.

Release Notes

2.1.0

BREAKING CHANGES This release includes breaking changes. If upgrading to this version, read these Release Notes carefully before upgrading and use helm template to compare the output with that from your current version to ensure the result is as expected.

• The minimum Appian Operator version compatible with this chart is v0.200.0.

• Breaking Change securityContext is now a pure passthrough to corev1.SecurityContext (container-level), aligning with the Appian Operator v0.200.0+ CRD. If you previously set fsGroup or fsGroupChangePolicy under securityContext (globally or per-component), you must move these to podSecurityContext. These fields are deprecated on securityContext and will be removed by the operator in a future release.

• New podSecurityContext field added as a pure passthrough to corev1.PodSecurityContext (pod-level). Supports global and per-component override, same pattern as securityContext and nodeSelector.

Migration example — if your current values contain:

xxxxxxxxxx
# Old (pre-2.1.0)
securityContext:
  runAsUser: 500
  fsGroup: 500
  fsGroupChangePolicy: OnRootMismatch

Update to:

xxxxxxxxxx
# New (2.1.0+)
securityContext:
  runAsUser: 500
  allowPrivilegeEscalation: false
podSecurityContext:
  fsGroup: 500
  fsGroupChangePolicy: OnRootMismatch

The same applies at component level — e.g. httpd.securityContext.fsGroup becomes httpd.podSecurityContext.fsGroup.

2.0.0

BREAKING CHANGES This release includes breaking changes. If upgrading to this version, read these Release Notes carefully before upgrading and use helm tempalate to compare the output with that from your current version to ensure the result is as expected.

• The minimum Appian Operator version compatible with this chart is v0.194.0.

• Corrected data source template for Oracle so the connection URL includes the required leading // after the @.

• Support setting securityContext globally for all components, or at component level as [component].securityContext.

• Support disabling the built-in Search Server init container that sets vm.max_map_count on the worker node via the new field searchServer.setVmMaxMapCount. This field defaults to true. If you choose to disable this init container, you must ensure via other means that vm.max_map_count is correctly set on all worker nodes onto which Search Server pods could be provisioned.

• Support setting images.pullPolicy to be applied to all components and built-in init containers.

• Removed support for deprecated dataSources.mysqlDriverConfigMapName field.

• Added default CPU and memory requests and limits to httpd. Default httpd resources can be overridden in the same way as other components (instead of via the removed field httpd.resources).

• httpd affinity rules updated to allow the n+1 httpd pod that is launched to run on the same worker as another pod if required, to ensure it is able to run and terminate. This avoids being left with a stuck httpd pod when httpd replica count is <= number of worker nodes.

• Support setting spec.[component].serviceAccount field for a component.

• The chart sets the custom property server.conf.processcommon.AUTODELETE_ARCHIVES_DELAY_DAYS to a default of 30 days to automatically clean up archived processes. This can be customised via webapp.autodeleteArchivesDelayDays. If not customised, this will now result in your archived processes being automatically deleted after 30 days.

• Support OpenShift Default ingress controller as ingressTemplate.

• Chart now sets the new custom properties used by the Appian Data Service since 25.1 ads.adb.systemConfig__.rts.memory_limit and ads.adb.systemConfig__.rts.threads, instead of the deprecated rts.queryMemoryLimits.circuitBreaker.threshold.bytes. Removed corresponding override field dataServer.rts.queryMemoryCircuitBreakerThresholdBytes and added new override fields under dataServer.rts.

• Restructured or renamed some existing chart values fields to align with a more standardised naming approach (see table below).

• The chart no longer populates spec.httpd.nslookupImage (which is not used from Operator v0.194.0).

• Data source username field dataSources.[primary\|business[]].username has been removed in favour of providing the username(s) via a secret dataSources.[primary\|business[]].usernameSecretKeyRef.

Values field restructuring

Some of the fields have been restructured in this release to be more user friendly. The following table provides a guide to help you update your values files to use the new field name.

Built against Appian operator v0.194.0 and Appian platform 25.4. This chart will work with older and newer versions of the Appian operator (to a minimum of v0.194.0) and Appian platform, but some parameters may not be valid.

1.2.0

• Removed searchServerPassword field. From Operator v0.181.0, and Appian platform versions hotfixed from July 03, 2025 or later, the Operator now manages the Search Server password for you. Manually specifying a Search Server password is no longer required nor recommended. If you previously configured a Search Server password, you must remove this from your passwords.properties file when upgrading to this version of the Helm chart (see this KB for more details).

Built against Appian operator v0.181.0 and Appian platform 25.3. This chart will work with older and newer versions of the Appian operator (to a minimum of v0.181.0) and Appian platform, but some parameters may not be valid.

1.1.3

• Fixed Search Server CPU requests for Medium t-shirt size to 200m.

Built against Appian operator v0.178.0 and Appian platform 25.3. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

1.1.2

• Fixed issue where setting disableResourceRequests: true removed resource requests altogether but left limits in place, resulting in Kubernetes automatically adding resource requests back in and set to the same values as the limits. Now, setting disableResourceRequests: true sets resource requests to 0 to prevent this.

Built against Appian operator v0.173.0 and Appian platform 25.1. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum operator version tested with this Helm chart is v0.159.0.

1.1.1

• Fixed issue where webapp.engineOverrides field could not be set as it was incorrectly defined as an array instead of an object.

• Support setting webapp.minHeapSize to configure webapp's minimum heap size instead of using customProperties.

Built against Appian operator v0.173.0 and Appian platform 25.1. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum operator version tested with this Helm chart is v0.159.0.

1.1.0

• Minor increase to Search Server CPU requests for Small and Medium t-shirt sizes in-line with public docs update.

• Added dataServer.class field to enable independent scaling of the Data Service component without changing global t-shirt size.

• Breaking Change Aligned Data Service t-shirt sizing with latest public docs. This keeps resources relatively similar to earlier versions, but reduces RTS count for each t-shirt size. Use the new dataServer.class field or the dataServer.rts.count field to readjust if required.

• Breaking Change CPU limits are no longer set by default. This is to align with K8s best practices (where accurate CPU limits for the specific usage scenario are not already known). CPU limits can be applied by setting the new field disableCpuLimits to false (it defaults to true). If enabled, the t-shirt size's CPU limits are applied. This can be overridden globally by setting the new field defaultCpuLimits or overridden per component by setting [component].cpuLimits. The field workerNodeTotalCpu has been removed in favour of defaultCpuLimits. Previous chart behaviour can be achieved by setting disableCpuLimits to false and setting defaultCpuLimits to the previous value of workerNodeTotalCpu.

• Breaking Change Removed serviceManager.cpuLimits and serviceManager.memoryLimits fields. Use serviceManager.default.cpuLimits and serviceManager.default.memoryLimits instead.

• disableResourceRequests now sets no resources.requests at all, rather than incorrectly setting them to 0.

• Deprecated dataSources.mysqlDriverConfigMapName, which enabled deploying the MySQL driver via a ConfigMap and webapp init container. The supported MySQL driver is now too large to be mounted via a ConfigMap. This field will be removed in a future version.

• Fixed broken public docs links

Built against Appian operator v0.173.0 and Appian platform 25.1. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum operator version tested with this Helm chart is v0.159.0.

1.0.3

• Fixed an issue with the AGIC Ingress Template where an invalid ingressClassName was set. It now sets the annotation kubernetes.io/ingress.class instead, to the correct value, instead of setting ingressClassName.

• AGIC Ingress Template now defaults ingressTemplate.usePrivateIp to false instead of true.

Built against Appian operator v0.166.0 and Appian platform 24.4. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum supported operator version is v0.159.0.

1.0.2

• Allow storage.haSharedData to be specified when not in a high availability configuration

• No longer enforces passwordsPropertiesSecretName to be set (as this need only be provided and loaded at first environment startup)

• Support override of serviceManager.replicas in high availability configurations (from the default 3)

Built against Appian operator v0.166.0 and Appian platform 24.4. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum supported operator version is v0.159.0.

1.0.1

• Fixed bug preventing ingress from being used to completely override the templated ingress ingressTemplate

Built against Appian operator v0.166.0 and Appian platform 24.4. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum supported operator version is v0.159.0.

1.0.0

• Fixed bug preventing webapp.dataSources from being used to completely override the templated data sources dataSources.primary and dataSources.business

• Fixed bug where CPU and memory limits were not set for execution, analytics, groups, collaboration and process design engines when applying t-shirt sizes

• Default value of the Data Service custom property rts.queryMemoryLimits.circuitBreaker.threshold.bytes automatically set based on RTS count

• Added webapp.customLoggers to facilitate the addition of customized application logging

• Added metricsAuthToken to enable Appian Self-Managed Monitoring metrics API

• Added cascadeVersionToComponentTags for compatibility with the Appian Migration Tool

• Built-in SMTP-related custom properties are only added by the chart if smtp.host is provided

• serviceManager.maxExecEngineLoadMetric is now an integer (corrected from string)

• dataServer.rts.count is now an integer (corrected from string)

• dataServer.rts.queryMemoryCircuitBreakerThresholdBytes is now an integer (corrected from string)

Built against Appian operator v0.166.0 and Appian platform 24.4. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum supported operator version is v0.159.0.

0.1.2

• Added disableResourceRequests for running on smaller, dedicated worker nodes

Built against Appian operator v0.161.0 and Appian platform 24.3. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum supported operator version is v0.156.0.

0.1.1

• Supports new Search Server API password (introduced in 24.3)

• Minor bug fixes

Built against Appian operator v0.161.0 and Appian platform 24.3. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

Minimum supported operator version is now v0.156.0.

0.1.0

First public release.

Built against Appian operator v0.156.0 and Appian platform 24.1. This chart will work with other versions of the Appian operator and platform, both older and newer, but some parameters may not be valid (e.g. spec.rpa was only introduced from v0.156.0).

License

Appian AppMarket (see here)