OpenHands · chuckbutkus · Mar 3, 2026 · Feb 20, 2026 · Feb 20, 2026 · Feb 20, 2026
diff --git a/charts/openhands/Chart.lock b/charts/openhands/Chart.lock
@@ -22,6 +22,6 @@ dependencies:
   version: 20.3.0
 - name: runtime-api
   repository: oci://ghcr.io/all-hands-ai/helm-charts
-  version: 0.1.20
-digest: sha256:993e079383b8356e71d7b12cdc0ae82ee0747f5ce72a9d7307471aa2c9be0da9
-generated: "2026-01-15T17:32:49.752308-05:00"
+  version: 0.1.21-alpha.304
+digest: sha256:91de387fcf3da78462ebabb94fb05a5c04733362c9e70c87f3bf56ad583abd1b
+generated: "2026-03-03T15:22:05.190106883-05:00"
diff --git a/charts/openhands/Chart.yaml b/charts/openhands/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 description: OpenHands is an AI-driven autonomous software engineer
 name: openhands
 appVersion: 0.62.0
-version: 0.2.1
+version: 0.2.3
 maintainers:
   - name: rbren
   - name: xingyao
@@ -38,5 +38,5 @@ dependencies:
     condition: redis.enabled
   - name: runtime-api
     repository: oci://ghcr.io/all-hands-ai/helm-charts
-    version: 0.1.20
+    version: 0.1.21
     condition: runtime-api.enabled
diff --git a/charts/openhands/templates/_env.yaml b/charts/openhands/templates/_env.yaml
@@ -49,6 +49,10 @@
 - name: FILE_STORE
   value: {{ .Values.filestore.type }}
 {{- end }}
+{{- if .Values.filestore.provider }}
+- name: SHARED_EVENT_STORAGE_PROVIDER
+  value: {{ .Values.filestore.provider }}
+{{- end }}
 {{- if .Values.runtime.runAsRoot }}
 - name: SANDBOX_USER_ID
   value: '0'
@@ -187,7 +191,7 @@
 - name: LITE_LLM_API_URL
   value: {{ .Values.litellm.url }}
 {{- end }}
-{{- if index .Values "litellm-helm" "enabled" }}
+{{- if and (index .Values "litellm-helm") (index .Values "litellm-helm" "enabled") }}
 - name: LITE_LLM_API_KEY
   valueFrom:
     secretKeyRef:

diff --git a/charts/openhands/templates/service.yaml b/charts/openhands/templates/service.yaml
@@ -13,7 +13,7 @@ spec:
   selector:
     app: openhands
   type: ClusterIP
-{{- if index .Values "runtime-api" "enabled" }}
+{{- if and (index .Values "runtime-api") (index .Values "runtime-api" "enabled") }}
 ---
 apiVersion: v1
 kind: Service
@@ -69,7 +69,7 @@ spec:
     app.kubernetes.io/name: redis
     app.kubernetes.io/component: master
 {{- end }}
-{{- if index .Values "litellm-helm" "enabled" }}
+{{- if and (index .Values "litellm-helm") (index .Values "litellm-helm" "enabled") }}
 ---
 apiVersion: v1
 kind: Service

diff --git a/charts/openhands/templates/wait-for-postgres.job.yaml b/charts/openhands/templates/wait-for-postgres.job.yaml
@@ -0,0 +1,43 @@
+{{- if and .Values.postgresql.enabled .Values.migrationJob.enabled (not .Values.externalDatabase.enabled) }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: wait-for-postgres
+  annotations:
+    "helm.sh/hook": "post-install,post-upgrade"
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
+spec:
+  ttlSecondsAfterFinished: 300
+  backoffLimit: 30
+  activeDeadlineSeconds: 300
+  template:
+    metadata:
+      name: wait-for-postgres
+    spec:
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      restartPolicy: OnFailure
+      {{- with .Values.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: wait-for-postgres
+          image: "bitnamilegacy/postgresql:latest"
+          command: ['sh', '-c']
+          args:
+            - |
+              DB_HOST="oh-main-postgresql"
+              echo "Waiting for PostgreSQL at $DB_HOST to be ready..."
+              until PGPASSWORD=$DB_PASS psql -h $DB_HOST -p 5432 -U postgres -c '\q' > /dev/null 2>&1; do
+                echo "PostgreSQL is unavailable - sleeping for 2 seconds"
+                sleep 2
+              done
+              echo "PostgreSQL is up and running!"
+          env:
+            {{- include "openhands.env" . | nindent 12 }}
+{{- end }}
diff --git a/charts/runtime-api/Chart.lock b/charts/runtime-api/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: postgresql
   repository: https://charts.bitnami.com/bitnami
-  version: 15.5.38
+  version: 15.5.32
 - name: helm-release-pruner
   repository: https://charts.fairwinds.com/stable
   version: 3.3.0
-digest: sha256:9f911cd2f97b7cbaa03b13b538f1ee44e0fb589f40c797c71ccc032e3a669ba5
-generated: "2025-08-12T22:14:25.137674542-04:00"
+digest: sha256:2624e849f4565a8eb318f74efecedb84037f025f80796663db9c78f4bcdd80a8
+generated: "2024-09-18T17:44:55.142745222-04:00"
diff --git a/charts/runtime-api/Chart.yaml b/charts/runtime-api/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: runtime-api
-description: A Helm chart for the Flask application
-version: 0.1.20 # Change this to trigger a new helm chart version being published
+description: A Helm chart for the FastAPI application
+version: 0.1.21 # Change this to trigger a new helm chart version being published
 appVersion: "1.0.0"
 dependencies:
   - name: postgresql

diff --git a/charts/runtime-api/templates/cleanup-cronjob.yaml b/charts/runtime-api/templates/cleanup-cronjob.yaml
@@ -7,8 +7,11 @@ metadata:
 spec:
   schedule: {{ .Values.cleanup.schedule | quote }}
   concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: {{ .Values.jobSettings.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ .Values.jobSettings.failedJobsHistoryLimit }}
   jobTemplate:
     spec:
+      activeDeadlineSeconds: {{ .Values.jobSettings.activeDeadlineSeconds }}
       template:
         spec:
           {{- with .Values.securityContext }}
@@ -43,5 +46,7 @@ spec:
               - name: ingress-base-config
                 mountPath: /ingress-base
             {{- end }}
+            resources:
+              {{- toYaml .Values.jobSettings.resources | nindent 14 }}
           restartPolicy: OnFailure
 {{- end }}
diff --git a/charts/runtime-api/templates/create-db-user-job.yaml b/charts/runtime-api/templates/create-db-user-job.yaml
@@ -7,6 +7,7 @@ metadata:
     "helm.sh/hook": "pre-install,pre-upgrade"
     "helm.sh/hook-weight": "-10"
 spec:
+  activeDeadlineSeconds: {{ .Values.jobSettings.activeDeadlineSeconds }}
   template:
     spec:
       {{- with .Values.securityContext }}
@@ -27,6 +28,8 @@ spec:
             secretKeyRef:
               name: postgres-password
               key: password
+        resources:
+          {{- toYaml .Values.jobSettings.resources | nindent 10 }}
         command:
           - sh
           - -c

diff --git a/charts/runtime-api/templates/db-cleanup-cronjob.yaml b/charts/runtime-api/templates/db-cleanup-cronjob.yaml
@@ -8,10 +8,11 @@ metadata:
 spec:
   schedule: {{ .Values.dbCleanup.schedule | quote }}
   concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: {{ .Values.dbCleanup.successfulJobsHistoryLimit }}
-  failedJobsHistoryLimit: {{ .Values.dbCleanup.failedJobsHistoryLimit }}
+  successfulJobsHistoryLimit: {{ .Values.jobSettings.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ .Values.jobSettings.failedJobsHistoryLimit }}
   jobTemplate:
     spec:
+      activeDeadlineSeconds: {{ .Values.jobSettings.activeDeadlineSeconds }}
       template:
         spec:
           {{- with .Values.securityContext }}
@@ -47,5 +48,7 @@ spec:
               - name: ingress-base-config
                 mountPath: /ingress-base
             {{- end }}
+            resources:
+              {{- toYaml .Values.jobSettings.resources | nindent 14 }}
           restartPolicy: OnFailure
 {{- end }}
diff --git a/charts/runtime-api/templates/deployment.yaml b/charts/runtime-api/templates/deployment.yaml
@@ -14,35 +14,32 @@ spec:
       labels:
         {{- include "runtime-api.selectorLabels" . | nindent 8 }}
     spec:
-      serviceAccountName: {{ .Values.serviceAccount.name }}
       {{- with .Values.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if or .Values.warmRuntimes.enabled .Values.ingressBase.enabled }}
       volumes:
-      {{- if .Values.warmRuntimes.enabled }}
+        {{- if .Values.warmRuntimes.enabled }}
         - name: warm-runtimes-config
           configMap:
             name: {{ .Values.warmRuntimes.configMapName }}
-      {{- end }}
-      {{- if .Values.ingressBase.enabled }}
+        {{- end }}
+        {{- if .Values.ingressBase.enabled }}
         - name: ingress-base-config
           configMap:
             name: {{ include "runtime-api.fullname" . }}-ingress-base
+        {{- end }}
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if .Values.datadog.enabled }}
-          command: ["/bin/sh", "-c", "ddtrace-run python -m flask run --host=0.0.0.0"]
-          {{- else }}
-          command: ["/bin/sh", "-c", "python -m flask run --host=0.0.0.0"]
-          {{- end }}
           ports:
             - name: http
               containerPort: 5000

diff --git a/charts/runtime-api/templates/migrate-db.job.yaml b/charts/runtime-api/templates/migrate-db.job.yaml
@@ -5,26 +5,31 @@ metadata:
   labels:
     {{- include "runtime-api.labels" . | nindent 4 }}
   annotations:
+  {{- if not (or .Values.postgresql.enabled .Values.postgresql.postMigrate) }}
+    "helm.sh/hook": "pre-install,pre-upgrade"
+  {{- else }}
     "helm.sh/hook": "post-install,post-upgrade"
+  {{- end }}
     "helm.sh/hook-weight": "-5"
   {{- if .Values.postgresql.isFeatureDeploy }}
     "helm.sh/hook-delete-policy": "hook-succeeded"
   {{- else }}
     "helm.sh/hook-delete-policy": "before-hook-creation"
   {{- end }}
 spec:
+  activeDeadlineSeconds: {{ .Values.jobSettings.activeDeadlineSeconds }}
   template:
     metadata:
       name: {{ include "runtime-api.fullname" . }}-migrate-db
       labels:
         {{- include "runtime-api.selectorLabels" . | nindent 8 }}
     spec:
-      serviceAccountName: {{ .Values.serviceAccount.name }}
-      restartPolicy: OnFailure
       {{- with .Values.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}-hook
+      restartPolicy: OnFailure
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -35,28 +40,37 @@ spec:
           configMap:
             name: {{ include "runtime-api.fullname" . }}-ingress-base
       {{- end }}
-      {{- if .Values.externalDatabase.enabled }}
+      {{- if or .Values.externalDatabase.enabled .Values.postgresql.postMigrate }}
       initContainers:
-        - name: check-db-exists
+        - name: wait-for-postgres
           image: "bitnamilegacy/postgresql:latest"
           command: ['sh', '-c']
           args:
             - |
+              echo "Waiting for PostgreSQL at $DB_HOST to be ready..."
+              until PGPASSWORD=$DB_PASS psql -h $DB_HOST -p 5432 -U $DB_USER -d postgres -c '\q' > /dev/null 2>&1; do
+                echo "PostgreSQL is unavailable - sleeping for 2 seconds"
+                sleep 2
+              done
+              echo "PostgreSQL is up and running!"
+              {{- if .Values.externalDatabase.enabled }}
               echo "Checking if the DB \"$DB_NAME\" and user \"$DB_USER\" exist..."
               export PGPASSWORD=$DB_ADMIN_PASSWORD
               # Create the database if it doesn't exist
               psql -h $DB_HOST -p 5432 -U $DB_ADMIN_USER -d postgres -tc "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'" | grep -q 1 || \
               psql -h $DB_HOST -p 5432 -U $DB_ADMIN_USER -d postgres -c "CREATE DATABASE $DB_NAME;"
-
               # Create the user if it doesn't exist
               psql -h $DB_HOST -p 5432 -U $DB_ADMIN_USER -d $DB_NAME -tc "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'" | grep -q 1 || \
               (psql -h $DB_HOST -p 5432 -U $DB_ADMIN_USER -d $DB_NAME -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS'; GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;")
+              {{- end }}
           env:
+            {{- if .Values.externalDatabase.enabled }}
             - name: DB_ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ .Values.externalDatabase.existingSecret }}
                   key: admin_password
+            {{- end }}
             {{- include "runtime-api.env" . | nindent 12 }}
       {{- end }}
       containers:
@@ -70,3 +84,5 @@ spec:
             - name: ingress-base-config
               mountPath: /ingress-base
           {{- end }}
+          resources:
+            {{- toYaml .Values.jobSettings.resources | nindent 12 }}
diff --git a/charts/runtime-api/templates/monitoring.yaml b/charts/runtime-api/templates/monitoring.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.monitoring.enabled }}
+apiVersion: monitoring.googleapis.com/v1
+kind: PodMonitoring
+metadata:
+  name: {{ include "runtime-api.fullname" . }}-monitoring
+spec:
+  selector:
+    matchLabels:
+      {{- include "runtime-api.selectorLabels" . | nindent 6 }}
+  endpoints:
+  - port: 5000
+    interval: 30s
+    path: /metrics
+{{- end }}
diff --git a/charts/runtime-api/templates/pod-status-logger-cronjob.yaml b/charts/runtime-api/templates/pod-status-logger-cronjob.yaml
@@ -8,8 +8,11 @@ metadata:
 spec:
   schedule: {{ .Values.podStatusLogger.schedule | quote }}
   concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: {{ .Values.jobSettings.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ .Values.jobSettings.failedJobsHistoryLimit }}
   jobTemplate:
     spec:
+      activeDeadlineSeconds: {{ .Values.jobSettings.activeDeadlineSeconds }}
       template:
         spec:
           {{- with .Values.securityContext }}
@@ -39,5 +42,7 @@ spec:
               - name: ingress-base-config
                 mountPath: /ingress-base
             {{- end }}
+            resources:
+              {{- toYaml .Values.jobSettings.resources | nindent 14 }}
           restartPolicy: OnFailure
 {{- end }}
diff --git a/charts/runtime-api/templates/serviceaccount.yaml b/charts/runtime-api/templates/serviceaccount.yaml
@@ -5,10 +5,21 @@ metadata:
   name: {{ .Values.serviceAccount.name }}
   labels:
     {{- include "runtime-api.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccount.annotations }}
+  {{- with .Values.serviceAccount.annotations }}
   annotations:
-    {{- range $key, $value := .Values.serviceAccount.annotations }}
-    "{{ $key }}": "{{ $value }}"
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}-hook
+  labels:
+    {{- include "runtime-api.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": "pre-install,pre-upgrade"
+    "helm.sh/hook-weight": "-10"
+    {{- with .Values.serviceAccount.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 {{- end }}