Update keeptrack chart, create sidelab/liveship charts#58
Merged
Conversation
The launcher now keeps session state in the database (shared across replicas, survives restarts and rollouts — lab pods are no longer deleted on SIGTERM), discovers tenant namespaces by label, and no longer clones courses launcher-side on the kubernetes backend. - replicaCount/autoscaling/PDB comments: multi-replica is supported with database.backend=mongo (sqlite still pins to one Pod via its ReadWriteOnce PVC); the old "lost on restart" warning was stale - Deployment strategy: RollingUpdate when persistence is disabled (mongo backend, no local state), Recreate only while the RWO PVC is in play - persistence: no longer recommended for mongo — the launcher keeps no local state at all on the kubernetes backend - knownNamespaces: now optional extras; discovery uses the app.kubernetes.io/managed-by=sidelab namespace label Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FbDMLVo9o5rFRe9T6qqTwH
Critical fixes (chart is now functional) - deployment.yaml: DB connection vars renamed to DatabaseSettings__ConnectionString/DatabaseSettings__DatabaseName (matches ApplicationConfiguration.cs), with new webapi.db.connectionStringSecretKeyRef support - Application__IsSwaggerEnabled → Features__IsScalarEnabled; values.yaml field renamed enableSwagger → enableScalar - Added dotnet.httpsRedirectionEnabled (defaults false, wired to Features__IsHttpsRedirectionEnabled) Medium fixes - OTel toggle now sets the real OTEL_* env vars the auto-instrumentation agent reads (OTEL_TRACES_EXPORTER=none/otlp, OTEL_EXPORTER_OTLP_ENDPOINT, etc.) instead of dead config keys - Logging__LogLevel__Farseer → Logging__LogLevel__Devpro - webapi.tag now pins to 1.2.3 (matches Chart.yaml appVersion) instead of latest Hardening, brought in line with keeptrack - New templates/serviceaccount.yaml + security.serviceAccount.create, automountServiceAccountToken: false - security.hardened.enabled (seccomp, drop-all capabilities, read-only rootfs + /tmp emptyDir) - imagePullSecrets support - _helpers.tpl now defines commonLabels, applied across Deployment/Service/Ingress/ServiceAccount - ingress.yaml now gates on .host being set (was rendering a bogus tfbackend.random Ingress if enabled without an override) - Filled in NOTES.txt - Chart.yaml: bumped to 0.2.0, appVersion corrected to 1.2.3, added home/sources/keywords - CONTRIBUTING.md/values.mine.yaml: renamed fields, fixed stale /swagger reference → /scalar Verified with helm lint and helm template across default values, hardened+serviceAccount+imagePullSecrets+OTel-enabled+secretKeyRef, and ingress-without-host scenarios — all render correctly and match the app's actual config surface.
Modeled on sidelab (closest shape: single app + optional bundled MongoDB) with keeptrack conventions where relevant: - Full template set: deployment, service, ingress, configmap, secrets, serviceaccount, HPA, PDB, NOTES.txt, plus README, CONTRIBUTING, ci/ci-values.yaml for ct lint. - Image: defaults to ghcr.io/devpro/liveship per your note; values and README document that imagePullSecrets is required while the GHCR package is private. - Secrets: NEXTAUTH_SECRET and ENCRYPTION_KEY auto-generate on first install and are reused across upgrades (sidelab's lookup pattern). The generated key is guaranteed 64-hex (randAlphaNum 64 | sha256sum), and a user-supplied key is validated at render time. The GitOps rotation warning is stronger here than sidelab's, since a rotated ENCRYPTION_KEY makes stored connection credentials permanently undecryptable — NOTES.txt tells you to back it up. - Database: database.uri / database.existingSecret / bundled Bitnami mongodb subchart (same 18.6.16 dependency; the tgz was copied from sidelab because Bitnami's registry 401s on that version now — noted in CONTRIBUTING). database.name defaults to terraform_backend so it shares data with terraform-backend-mongodb out of the box. - NEXTAUTH_URL is derived from the ingress host+TLS automatically (wrong value breaks login, so the chart owns it), overridable via auth.url. - Probes hit /login — the app has no health endpoint (see below). - Verified: helm lint clean, full renders inspected, all four fail-fast validations produce clear messages, yamllint output byte-for-byte matches sidelab's warnings (so CI will pass), helm dependency list reports ok.
Closed all 5 remaining gaps, following the sidelab/liveship patterns: 1. Mongo URL auto-wiring — new terraform-backend-mongodb.mongoConnectionString helper (_helpers.tpl): derives mongodb://root:<rootPassword>@<release>-mongodb:27017/?authSource=admin when mongodb.enabled=true. values.mine.yaml/CONTRIBUTING.md simplified to drop the now-unnecessary hand-written connection string. 2. Fail-fast validation — new terraform-backend-mongodb.validateValues helper, called from secret.yaml and ingress.yaml. Placeholder defaults (someconnstring) removed; an unconfigured DB, a mongodb.enabled=true without rootPassword, or ingress.enabled=true without webapi.host now abort the render with a clear Error: instead of producing a broken manifest. 3. fullname prefixing — new helper prefixes webapi.name with the release name (unless already contained), applied to every resource name and selector label (Deployment, Service, Ingress, ServiceAccount, Secret). Two releases with default values no longer collide; the documented helm install tfbackend ... case is unchanged (release name already equals the default app name). 4. Optional nodeAffinity — moved from a hardcoded template block to webapi.affinity in values.yaml (defaults preserved: amd64-only, since the OTel native library is amd64-only), overridable/clearable per install. 5. Real Secret for the connection string — new templates/secret.yaml. By default DatabaseSettings__ConnectionString is now always sourced via secretKeyRef, never a plain env value: either the user's own pre-created Secret (connectionStringSecretKeyRef) or a Secret the chart manages itself (populated from connectionString or the Mongo auto-wiring above). Plus documentation (per your last note) — added a "Database connection" section to README.md covering all three ways to supply the DB credential, in priority order, with working examples for each (verified each snippet against helm template output). Chart version bumped to 0.3.0. Verified with helm lint/helm template: all three fail-fast error paths fire correctly, the three documented connection paths render as described, fullname prefixing works under both matching and differing release names, and clearing webapi.affinity removes the block entirely.
Bump chart version to 0.2.3
This matches keeptrack's pattern exactly: default (no connectionStringSecretKeyRef) now renders as a plain value: env var, and secretKeyRef is opt-in only when the user supplies their own pre-created Secret. Summary of changes to charts/terraform-backend-mongodb: - templates/secret.yaml — deleted (no more auto-generated Secret, matching keeptrack) - templates/deployment.yaml — default branch now renders DatabaseSettings__ConnectionString as a plain value: instead of secretKeyRef to the deleted Secret; the opt-in connectionStringSecretKeyRef path is unchanged - templates/_helpers.tpl, templates/NOTES.txt, values.yaml, README.md — comments/docs updated to reflect the new behavior
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.