Repository navigation
feat: Helm chart, production dashboard image, and Kubernetes CI/CD - #6
Merged
Merged
Conversation
Helm chart (deploy/helm/heightproof) - API, worker and dashboard Deployments; optional bundled Postgres and Redis StatefulSets with PVCs, or external URLs. - Secrets generated once and reused across upgrades (lookup), or an existingSecret. - Migrations from infra/migrations (symlinked, single source) applied by an init container under a Postgres advisory lock. - Workers use the pod name as Redis consumer name: the default worker-<pid> is worker-1 in every container, so replicas collided. - API startup and liveness probes use /health; readiness uses /ready, which answers 503 when the pod cannot reach Postgres or Redis and ignores the worker's backlog, so a slow worker never takes API pods out of rotation. Alert on /health/pipeline. - Non-root (explicit UID: images use USER node), RuntimeDefault seccomp, read-only root fs, dropped caps, no SA token. - Optional ingress, HPA, PDB; Prometheus scrape annotations; helm test. Production dashboard image: static Vite build on unprivileged nginx that proxies /v1, /ready, /health and the /live WebSocket on the same origin. An empty VITE_HEIGHTPROOF_API_URL now means same-origin. Workflows - kubernetes.yml: chart lint/render, then a kind e2e install that runs helm test and checks events flow API -> Redis -> worker -> Postgres. - release.yml: multi-arch GHCR images with SBOM/provenance on main and tags; chart pushed as an OCI artifact on v* tags.
macjayz
added a commit
that referenced
this pull request
Oct 29, 2026
main already carries this chart via #6. Resolve every conflict to main's version, keeping only the dashboard nginx route for /health/pipeline so the pipeline check is reachable on the dashboard's origin too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #1 with the same chart, rebuilt on top of #3 and #4 so it merges cleanly and uses the new readiness split.
What's in it
deploy/helm/heightproof): API, worker and dashboard Deployments; optional bundled Postgres/Redis StatefulSets or external URLs; secrets reused across upgrades; migrations applied by an init container under an advisory lock; workers use the pod name as consumer name; non-root, read-only root fs, dropped caps; optional ingress, HPA, PDB;helm test.kubernetes.yml(lint, render, kind e2e) andrelease.yml(multi-arch GHCR images, chart as OCI artifact on tags).Changes from #1
/ready(was/health). After fix: keep the pipeline alive through failures and apply each event exactly once #3,/readyanswers 503 when the pod can't reach Postgres or Redis and deliberately ignores the worker's backlog, so a slow worker can't take API pods out of rotation. Startup/liveness stay on/health. Chart README updated; alert on/health/pipeline.apiBasechange moved toapps/dashboard/src/api.ts(the dashboard was split in refactor(dashboard): split main.tsx into modules #4).Verified
helm lintclean.deploy/kind/e2e.shon a local kind cluster: all pods Ready (API via/ready),helm testpassed, 138 seeded events persisted by 2 workers. The first run of that test exposed a real bug: the consumer group was created at$, so events the API accepted before the first worker started were skipped forever. Fixed in #3 (group starts at0, with an integration test).Merge order: #3 → #4 → this.