feature: replace mw branding w aisquared #86
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: {{ include "chart.fullname" . }}-config | ||
| namespace: {{ .Values.kubernetesNamespace }} | ||
| labels: | ||
| io.kompose.service: {{ include "chart.fullname" . }}-config | ||
| {{- include "chart.labels" . | nindent 4 }} | ||
| data: | ||
| ALLOWED_HOST: {{ .Values.aisquaredConfig.allowedHost | quote }} | ||
| API_HOST: {{ .Values.aisquaredConfig.apiHost | quote }} | ||
| APP_ENV: {{ .Values.aisquaredConfig.appEnv | quote }} | ||
| APP_REVISION: {{ .Values.aisquaredConfig.appRevision | quote }} | ||
| APPSIGNAL_APP_ENV: {{ .Values.aisquaredConfig.appEnv | quote }} | ||
| APPSIGNAL_PUSH_API_KEY: {{ .Values.aisquaredConfig.appsignalPushApiKey | quote }} | ||
| AWS_ACCESS_KEY_ID: {{ .Values.aisquaredConfig.awsAccessKeyId | quote }} | ||
| AWS_SECRET_ACCESS_KEY: {{ .Values.aisquaredConfig.awsSecretAccessKey | quote }} | ||
| BRAND_NAME: {{ .Values.aisquaredConfig.smtpBrandName | quote }} | ||
| DATABRICKS_DRIVER_PATH: {{ .Values.aisquaredConfig.databricksDriverPath | quote }} | ||
| DB_PORT: {{ .Values.aisquaredConfig.dbPort | quote }} | ||
| DB_HOST: {{ .Values.aisquaredConfig.dbHost | quote }} | ||
| {{ if not .Values.secretsStore.enabled }} | ||
| DB_PASSWORD: {{ .Values.aisquaredConfig.dbPassword | quote }} | ||
| DB_USERNAME: {{ .Values.aisquaredConfig.dbUsername | quote }} | ||
| {{ end }} | ||
| GRPC_ENABLE_FORK_SUPPORT: {{ .Values.aisquaredConfig.grpcEnableForkSupport | quote }} | ||
| JWT_SECRET: {{ .Values.aisquaredConfig.jwtSecret | quote }} | ||
| NEW_RELIC_KEY: {{ .Values.aisquaredConfig.newRelicKey | quote }} | ||
| RAILS_ENV: {{ .Values.aisquaredConfig.railsEnv | quote }} | ||
| RAILS_LOG_LEVEL: {{ .Values.aisquaredConfig.railsLogLevel | quote }} | ||
| SECRET_KEY_BASE: {{ .Values.aisquaredConfig.secretKeyBase | quote }} | ||
| SKIP_DB_MIGRATION: {{ .Values.aisquaredConfig.skipDbMigration | quote }} | ||
| SMTP_ADDRESS: {{ .Values.aisquaredConfig.smtpAddress | quote }} | ||
| SMTP_HOST: {{ .Values.aisquaredConfig.smtpHost | quote }} | ||
| SMTP_PASSWORD: {{ .Values.aisquaredConfig.smtpPassword | quote }} | ||
| SMTP_PORT: {{ .Values.aisquaredConfig.smtpPort | quote }} | ||
| SMTP_USERNAME: {{ .Values.aisquaredConfig.smtpUsername | quote }} | ||
| SMTP_SENDER_EMAIL: {{ .Values.aisquaredConfig.smtpSenderEmail | quote }} | ||
| SNOWFLAKE_DRIVER_PATH: {{ .Values.aisquaredConfig.snowflakeDriverPath | quote }} | ||
| STORAGE_ACCESS_KEY: {{ .Values.aisquaredConfig.storageAccessKey }} | ||
| STORAGE_ACCOUNT_NAME: {{ .Values.aisquaredConfig.storageAccountName }} | ||
| SYNC_EXTRACTOR_BATCH_SIZE: {{ .Values.aisquaredConfig.syncExtractorBatchSize | quote }} | ||
| SYNC_EXTRACTOR_THREAD_POOL_SIZE: {{ .Values.aisquaredConfig.syncExtractorThreadPoolSize | quote }} | ||
| SYNC_LOADER_BATCH_SIZE: {{ .Values.aisquaredConfig.syncLoaderBatchSize | quote }} | ||
| SYNC_LOADER_THREAD_POOL_SIZE: {{ .Values.aisquaredConfig.syncLoaderThreadPoolSize | quote }} | ||
| TEMPORAL_ACTIVITY_THREAD_POOL_SIZE: {{ .Values.aisquaredConfig.temporalActivityThreadPoolSize | quote }} | ||
| TEMPORAL_CLIENT_CHAIN: {{ .Values.aisquaredConfig.temporalClientChain | quote }} | ||
| TEMPORAL_CLIENT_KEY: {{ .Values.aisquaredConfig.temporalClientKey | quote }} | ||
| TEMPORAL_HOST: {{ .Values.aisquaredConfig.temporalHost | quote }} | ||
| TEMPORAL_NAMESPACE: {{ .Values.aisquaredConfig.temporalNamespace | quote }} | ||
| TEMPORAL_PORT: {{ .Values.aisquaredConfig.temporalPort | quote }} | ||
| TEMPORAL_POSTGRES_DEFAULT_PORT: {{ .Values.aisquaredConfig.temporalPostgresDefaultPort | quote }} | ||
| TEMPORAL_POSTGRES_PASSWORD: {{ .Values.aisquaredConfig.temporalPostgresPassword | quote }} | ||
| TEMPORAL_POSTGRES_USER: {{ .Values.aisquaredConfig.temporalPostgresUser | quote }} | ||
| TEMPORAL_POSTGRESQL_VERSION: {{ .Values.aisquaredConfig.temporalPostgresqlVersion | quote }} | ||
| TEMPORAL_ROOT_CERT: {{ .Values.aisquaredConfig.temporalRootCert | quote }} | ||
| TEMPORAL_TASK_QUEUE: {{ .Values.aisquaredConfig.temporalTaskQueue | quote }} | ||
| TEMPORAL_UI_VERSION: {{ .Values.aisquaredConfig.temporalUiVersion | quote }} | ||
| TEMPORAL_VERSION: {{ .Values.aisquaredConfig.temporalVersion | quote }} | ||
| TEMPORAL_WORKFLOW_THREAD_POOL_SIZE: {{ .Values.aisquaredConfig.temporalWorkflowThreadPoolSize | quote }} | ||
| UI_HOST: {{ .Values.aisquaredConfig.uiHost | quote }} | ||
| USER_EMAIL_VERIFICATION: {{ .Values.aisquaredConfig.userEmailVerification | quote }} | ||
| VITE_API_HOST: {{ .Values.aisquaredConfig.viteApiHost | quote }} | ||
| VITE_APPSIGNAL_PUSH_API_KEY: {{ .Values.aisquaredConfig.viteAppsignalPushApiKey | quote }} | ||
| VITE_BRAND_NAME: {{ .Values.aisquaredConfig.viteBrandName | quote }} | ||
| VITE_LOGO_URL: {{ .Values.aisquaredConfig.viteLogoUrl | quote }} | ||
| VITE_BRAND_COLOR: {{ .Values.aisquaredConfig.viteBrandColor | quote }} | ||
| VITE_BRAND_HOVER_COLOR: {{ .Values.aisquaredConfig.viteBrandHoverColor | quote }} | ||
| VITE_FAV_ICON_URL: {{ .Values.aisquaredConfig.viteFavIconUrl | quote }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| {{ if .Values.aisquaredPostgresql.enabled }} | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
|
|
@@ -8,23 +8,23 @@ metadata: | |
| io.kompose.service: {{ include "chart.fullname" . }}-postgresql | ||
| {{- include "chart.labels" . | nindent 4 }} | ||
| annotations: | ||
| {{- with .Values.aisquaredPostgresql.annotations }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| spec: | ||
| replicas: {{ .Values.aisquaredPostgresql.replicas }} | ||
| selector: | ||
| matchLabels: | ||
| io.kompose.service: {{ include "chart.fullname" . }}-postgresql | ||
| {{- include "chart.selectorLabels" . | nindent 6 }} | ||
| template: | ||
| metadata: | ||
| labels: | ||
| io.kompose.network/aisquared-server-default: "true" | ||
| io.kompose.service: {{ include "chart.fullname" . }}-postgresql | ||
| {{- include "chart.selectorLabels" . | nindent 8 }} | ||
| annotations: | ||
| {{- with .Values.aisquaredPostgresql.annotations }} | ||
| {{ toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| spec: | ||
|
|
@@ -42,7 +42,7 @@ spec: | |
| name: {{ include "chart.fullname" . }}-config | ||
| - name: KUBERNETES_CLUSTER_DOMAIN | ||
| value: {{ quote .Values.kubernetesClusterDomain }} | ||
| image: {{ .Values.aisquaredPostgresql.aisquaredPostgresql.image.repository }}:{{ .Values.aisquaredPostgresql.aisquaredPostgresql.image.tag | default .Chart.AppVersion }} | ||
|
There was a problem hiding this comment. Likely incorrect values path (double aisquaredPostgresql nesting) These paths look off and will render empty unless the values are double-nested. Everywhere else (replicas/annotations) uses a single - image: {{ .Values.aisquaredPostgresql.aisquaredPostgresql.image.repository }}:{{ .Values.aisquaredPostgresql.aisquaredPostgresql.image.tag | default .Chart.AppVersion }}
+ image: {{ .Values.aisquaredPostgresql.image.repository }}:{{ .Values.aisquaredPostgresql.image.tag | default .Chart.AppVersion }}
@@
- resources: {{- toYaml .Values.aisquaredPostgresql.aisquaredPostgresql.resources | nindent 10 }}
+ resources: {{- toYaml .Values.aisquaredPostgresql.resources | nindent 10 }}Also applies to: 59-59 🤖 Prompt for AI Agents |
||
| livenessProbe: | ||
| initialDelaySeconds: 30 | ||
| periodSeconds: 10 | ||
|
|
@@ -56,7 +56,7 @@ spec: | |
| periodSeconds: 10 | ||
| tcpSocket: | ||
| port: 5432 | ||
| resources: {{- toYaml .Values.aisquaredPostgresql.aisquaredPostgresql.resources | nindent 10 }} | ||
| volumeMounts: | ||
| - mountPath: /var/lib/postgresql/data | ||
| subPath: postgres | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| {{ if .Values.aisquaredPostgresql.enabled }} | ||
| apiVersion: v1 | ||
| kind: PersistentVolumeClaim | ||
| metadata: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,4 +1,4 @@ | ||||||
| {{ if .Values.aisquaredPostgresql.enabled }} | ||||||
| apiVersion: v1 | ||||||
| kind: Service | ||||||
| metadata: | ||||||
|
|
@@ -8,10 +8,10 @@ metadata: | |||||
| io.kompose.service: {{ include "chart.fullname" . }}-postgresql | ||||||
| {{- include "chart.labels" . | nindent 4 }} | ||||||
| spec: | ||||||
| type: {{ .Values.aisquaredPostgresql.type }} | ||||||
| selector: | ||||||
| io.kompose.service: {{ include "chart.fullname" . }}-postgresql | ||||||
| {{- include "chart.selectorLabels" . | nindent 4 }} | ||||||
| ports: | ||||||
| {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}} | ||||||
|
There was a problem hiding this comment. 💡 Verification agent 🧩 Analysis chainTab character breaks YAML indentation; replace with spaces. Apply this diff: - {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}}
+ {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}}Optionally, you can also remove the preceding two literal spaces and change nindent to 4 for clarity: - {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}}
+{{- .Values.aisquaredPostgresql.ports | toYaml | nindent 4 -}}To scan for similar tab issues elsewhere: 🏁 Script executed: #!/bin/bash
# Find lines starting with tabs in Helm templates
rg -nP '^\t' charts/aisquared/templatesLength of output: 616 Replace leading tabs with spaces in Helm templates • temporal-ui-service.yaml:19 Each of these lines begins with a tab before the Helm expression. Please replace the leading tab with two spaces (or adjust to no leading spaces + - {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}}
+ {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}}Or, for clearer alignment, you can remove the two spaces and bump - {{- .Values.aisquaredPostgresql.ports | toYaml | nindent 2 -}}
+{{- .Values.aisquaredPostgresql.ports | toYaml | nindent 4 -}}Apply the same fix pattern to the other four templates above to ensure all YAML is valid. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| {{ end }} | ||||||
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,11 +8,11 @@ metadata: | |
| io.kompose.service: {{ include "chart.fullname" . }}-server | ||
| {{- include "chart.labels" . | nindent 4 }} | ||
| annotations: | ||
| {{- with .Values.aisquaredServer.annotations }} | ||
| {{ toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| spec: | ||
| replicas: {{ .Values.aisquaredServer.replicas }} | ||
| selector: | ||
| matchLabels: | ||
| app: {{ include "chart.fullname" . }}-server | ||
|
|
@@ -25,18 +25,18 @@ spec: | |
| io.kompose.service: {{ include "chart.fullname" . }}-server | ||
| {{- include "chart.selectorLabels" . | nindent 8 }} | ||
| annotations: | ||
| {{- with .Values.aisquaredServer.annotations }} | ||
| {{ toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| spec: | ||
| serviceAccountName: {{ .Values.serviceAccount.create | ternary .Values.serviceAccount.name "default" }} | ||
| automountServiceAccountToken: {{ .Values.automountServiceAccountToken.enabled }} | ||
| securityContext: | ||
| fsGroup: {{ .Values.aisquaredServer.podSecurityContext.fsGroup }} | ||
| initContainers: | ||
| {{ if .Values.securityContext.readOnlyRootFilesystem }} | ||
| - name: copy-config | ||
| image: {{ .Values.aisquaredServer.aisquaredServer.image.repository }}:{{ .Values.aisquaredServer.aisquaredServer.image.tag | default .Chart.AppVersion }} | ||
| imagePullPolicy: {{ .Values.globalImagePullPolicy }} | ||
| command: | ||
| - /bin/sh | ||
|
|
@@ -49,8 +49,8 @@ spec: | |
| - name: rails-config | ||
| mountPath: /mnt/rails | ||
| securityContext: | ||
| runAsUser: {{ .Values.aisquaredServer.aisquaredServer.containerSecurityContext.runAsUser }} | ||
| runAsGroup: {{ .Values.aisquaredServer.aisquaredServer.containerSecurityContext.runAsGroup }} | ||
| privileged: false | ||
| allowPrivilegeEscalation: {{ .Values.securityContext.allowPrivilegeEscalation }} | ||
| readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }} | ||
|
|
@@ -62,7 +62,7 @@ spec: | |
| {{- end }} | ||
| {{- end }} | ||
| {{ end }} | ||
| {{ if .Values.aisquaredConfig.azureSpot }} | ||
| tolerations: | ||
| - key: "kubernetes.azure.com/scalesetpriority" | ||
| operator: "Equal" | ||
|
|
@@ -107,20 +107,20 @@ spec: | |
| {{ end }} | ||
| {{ if .Values.multipleDbHosts.enabled }} | ||
| - name: DB_HOST | ||
| value: {{ .Values.multipleDbHosts.aisquaredDBHost }} | ||
| - name: DB_NAME | ||
| value: {{ .Values.multipleDbHosts.aisquaredDBName }} | ||
| {{ end }} | ||
| - name: KUBERNETES_CLUSTER_DOMAIN | ||
| value: {{ quote .Values.kubernetesClusterDomain }} | ||
| envFrom: | ||
| - configMapRef: | ||
| name: {{ include "chart.fullname" . }}-config | ||
| image: {{ .Values.aisquaredServer.aisquaredServer.image.repository }}:{{ .Values.aisquaredServer.aisquaredServer.image.tag | default .Chart.AppVersion }} | ||
| imagePullPolicy: {{ .Values.globalImagePullPolicy }} | ||
| securityContext: | ||
|
Comment on lines
120
to
121
There was a problem hiding this comment. 🛠️ Refactor suggestion Duplicate imagePullPolicy keys — unify to a single declaration The container has two imagePullPolicy keys. Duplicate keys are unsafe and can lead to unexpected behavior. Keep only one, preferably the values-driven one: @@
- imagePullPolicy: {{ .Values.globalImagePullPolicy }}
@@
- imagePullPolicy: Always
+ # imagePullPolicy controlled via .Values.globalImagePullPolicyAlso applies to: 150-151 🤖 Prompt for AI Agents |
||
| runAsUser: {{ .Values.aisquaredServer.aisquaredServer.containerSecurityContext.runAsUser }} | ||
| runAsGroup: {{ .Values.aisquaredServer.aisquaredServer.containerSecurityContext.runAsGroup }} | ||
| privileged: false | ||
| allowPrivilegeEscalation: {{ .Values.securityContext.allowPrivilegeEscalation }} | ||
| readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }} | ||
|
|
@@ -134,23 +134,23 @@ spec: | |
| livenessProbe: | ||
| httpGet: | ||
| path: / | ||
| port: {{ (index .Values.aisquaredServer.ports 0).port }} | ||
| initialDelaySeconds: 15 | ||
| periodSeconds: 10 | ||
| name: {{ include "chart.fullname" . }}-server | ||
| ports: | ||
| - containerPort: {{ (index .Values.aisquaredServer.ports 0).port }} | ||
| readinessProbe: | ||
| httpGet: | ||
| path: / | ||
| port: {{ (index .Values.aisquaredServer.ports 0).port }} | ||
| initialDelaySeconds: 5 | ||
| periodSeconds: 10 | ||
| resources: {{- toYaml .Values.aisquaredServer.aisquaredServer.resources | nindent 10 }} | ||
| imagePullPolicy: Always | ||
| volumeMounts: | ||
| {{ if .Values.secretsStore.enabled }} | ||
| - name: aisquared-secrets-store | ||
| mountPath: /run/secrets/mw-secrets | ||
| readOnly: true | ||
| {{ end }} | ||
|
|
@@ -180,7 +180,7 @@ spec: | |
| path: ./temporal.pem | ||
| {{ end }} | ||
| {{ if .Values.secretsStore.enabled }} | ||
| - name: aisquared-secrets-store | ||
| csi: | ||
| driver: secrets-store.csi.k8s.io | ||
| readOnly: true | ||
|
|
@@ -200,7 +200,7 @@ spec: | |
| emptyDir: {} | ||
| {{ end }} | ||
| restartPolicy: Always | ||
| {{ if .Values.aisquaredConfig.privateRepo }} | ||
| imagePullSecrets: | ||
| - name: {{ .Values.aisquaredConfig.registrySecretName }} | ||
| {{ end }} | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛠️ Refactor suggestion
Do not store secrets in a ConfigMap; move sensitive values to Kubernetes Secrets (or CSI).
Several keys here are sensitive and should not be stored in a ConfigMap: APPSIGNAL_PUSH_API_KEY, AWS_SECRET_ACCESS_KEY, JWT_SECRET, NEW_RELIC_KEY, SECRET_KEY_BASE, SMTP_PASSWORD, DB_PASSWORD/DB_USERNAME (already gated), TEMPORAL_POSTGRES_PASSWORD, etc. ConfigMaps are not meant for secrets and are readable cluster-wide by default RBAC. You already gate DB credentials behind
.Values.secretsStore.enabled; apply the same pattern or move these to a Secret/SecretProviderClass and reference them viaenv.valueFrom.secretKeyRefin your Deployments.Proposed minimal change for this template (gating additional secrets to avoid placing them in the ConfigMap when CSI is enabled):
Follow-up: I can also generate the corresponding Deployment env
valueFrom.secretKeyRefpatches and, if desired, a Secret template or CSI SecretProviderClass entries for these keys. Would you like me to open a follow-up PR/commit for that?Also applies to: 53-55, 27-31, 23-25, 35-35