feat(helm): add Helm chart for Presidio text services#2067
Open
binhnguyenduc wants to merge 2 commits into
Open
feat(helm): add Helm chart for Presidio text services#2067binhnguyenduc wants to merge 2 commits into
binhnguyenduc wants to merge 2 commits into
Conversation
Replace the outdated chart under docs/samples/deployments/k8s/charts with a new chart that deploys the Presidio text stack (presidio-analyzer and presidio-anonymizer) to Kubernetes, modeled on docker-compose-text.yml and scaffolded from `helm create`. - Single chart templating both services via shared helpers (DRY) - Hardened pod/container security context (non-root UID 1001, drop all capabilities, no privilege escalation, RuntimeDefault seccomp) - Standard app.kubernetes.io labels; per-component resources, replicas, image, env (PORT/WORKERS), and enable toggles - /health liveness/readiness probes plus a generous startup probe for the analyzer's slow NLP model load - Optional Ingress (routes both services) and HPA, disabled by default - values.schema.json validation, NOTES.txt, helm test hook, and README Update the surrounding sample to match the new chart values: - deploy-presidio.sh: use image.registry / image.tag; add --create-namespace - k8s/index.md: fix install examples, correct the ingress note (Ingress is no longer enabled by default), and port-forward the analyzer Service
Author
|
@microsoft-github-policy-service agree |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the Kubernetes Helm chart sample for Presidio’s text services (analyzer + anonymizer), modernizing chart structure, values, and docs/scripts for installation and exposure (Ingress / port-forward).
Changes:
- Refactors the Helm chart to use shared helper templates (deployment/service/HPA), adds a values JSON schema, and introduces a Helm test pod.
- Modernizes Ingress to
networking.k8s.io/v1, makes Ingress disabled by default, and updates docs to match. - Updates install scripts/docs to use new
image.registry/image.tagvalues and--create-namespace.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/samples/deployments/k8s/index.md | Updates port-forward and Helm install instructions to match new values keys and Ingress defaults. |
| docs/samples/deployments/k8s/deployment/deploy-presidio.sh | Updates Helm install flags for the new image.* values and creates the namespace. |
| docs/samples/deployments/k8s/charts/presidio/values.yaml | Replaces legacy flat values with structured chart values (image, security, ingress, per-component blocks). |
| docs/samples/deployments/k8s/charts/presidio/values.schema.json | Adds JSON schema for chart values validation. |
| docs/samples/deployments/k8s/charts/presidio/templates/tests/test-connection.yaml | Adds helm test hook to validate /health endpoints. |
| docs/samples/deployments/k8s/charts/presidio/templates/serviceaccount.yaml | Adds shared ServiceAccount support with optional token automount. |
| docs/samples/deployments/k8s/charts/presidio/templates/ingress.yaml | Replaces legacy ingress template with v1 Ingress supporting hosts/paths, TLS, and validations. |
| docs/samples/deployments/k8s/charts/presidio/templates/analyzer-*.yaml | Switches analyzer manifests to shared helper templates and conditional rendering (enabled). |
| docs/samples/deployments/k8s/charts/presidio/templates/anonymizer-*.yaml | Switches anonymizer manifests to shared helper templates and conditional rendering (enabled). |
| docs/samples/deployments/k8s/charts/presidio/templates/anonymizer-image-*.yaml | Removes image-redactor deployment/service from this chart’s scope. |
| docs/samples/deployments/k8s/charts/presidio/templates/_helpers.tpl | Adds common naming/labels and shared deployment/service/HPA templates. |
| docs/samples/deployments/k8s/charts/presidio/templates/NOTES.txt | Updates post-install notes with rollout guidance, ingress URLs, and port-forward examples. |
| docs/samples/deployments/k8s/charts/presidio/README.md | Adds chart README detailing scope, install, configuration, and ingress example. |
| docs/samples/deployments/k8s/charts/presidio/Chart.yaml | Updates chart metadata to Helm v3 best practices (type, home, keywords, versioning). |
| docs/samples/deployments/k8s/charts/presidio/.helmignore | Expands ignores for editor/CI artifacts. |
Comment on lines
+113
to
+120
| metadata: | ||
| annotations: | ||
| {{- with $root.Values.podAnnotations }} | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with $c.podAnnotations }} | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} |
Comment on lines
+245
to
+261
| metrics: | ||
| {{- if $c.autoscaling.targetCPUUtilizationPercentage }} | ||
| - type: Resource | ||
| resource: | ||
| name: cpu | ||
| target: | ||
| type: Utilization | ||
| averageUtilization: {{ $c.autoscaling.targetCPUUtilizationPercentage }} | ||
| {{- end }} | ||
| {{- if $c.autoscaling.targetMemoryUtilizationPercentage }} | ||
| - type: Resource | ||
| resource: | ||
| name: memory | ||
| target: | ||
| type: Utilization | ||
| averageUtilization: {{ $c.autoscaling.targetMemoryUtilizationPercentage }} | ||
| {{- end }} |
Comment on lines
+63
to
+79
| # Single Ingress fronting both services. Disabled by default. | ||
| # NOTE: the path rewrites below assume the ingress-nginx controller. | ||
| ingress: | ||
| enabled: false | ||
| className: nginx | ||
| annotations: {} | ||
| # nginx.ingress.kubernetes.io/rewrite-target: /$2 | ||
| hosts: | ||
| - host: presidio.local | ||
| paths: | ||
| - path: /analyzer(/|$)(.*) | ||
| pathType: ImplementationSpecific | ||
| # service references a component key below (analyzer | anonymizer). | ||
| service: analyzer | ||
| - path: /anonymizer(/|$)(.*) | ||
| pathType: ImplementationSpecific | ||
| service: anonymizer |
Comment on lines
+101
to
+114
| ingress: | ||
| enabled: true | ||
| className: nginx | ||
| annotations: | ||
| nginx.ingress.kubernetes.io/rewrite-target: /$2 | ||
| hosts: | ||
| - host: presidio.example.com | ||
| paths: | ||
| - path: /analyzer(/|$)(.*) | ||
| pathType: ImplementationSpecific | ||
| service: analyzer | ||
| - path: /anonymizer(/|$)(.*) | ||
| pathType: ImplementationSpecific | ||
| service: anonymizer |
Adds presidio-image-redactor as optional Helm service (disabled by default). Includes deployment, service, and HPA templates; updates schema and values.
SharonHart
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Description
Replaces the outdated Helm chart under
docs/samples/deployments/k8s/charts/presidiowith a new chart that deploys the Presidio text stack —
presidio-analyzerandpresidio-anonymizer— to Kubernetes. It mirrors the topology ofdocker-compose-text.ymland is scaffolded from
helm create, following Helm community best practices.Highlights:
rendered from shared named templates in
_helpers.tpl(a(dict "root" $ "name" ... "component" ...)context), so the two near-identical services share one source of truth.
1001baked into the images, with allcapabilities dropped,
allowPrivilegeEscalation: false, and theRuntimeDefaultseccomp profile.app.kubernetes.io/*labels (with acomponentlabel distinguishingthe workloads), per-component
resources,replicaCount, image overrides,PORT/WORKERSenv,and an
enabledtoggle per service./healthliveness/readiness plus a generousstartupProbeon theanalyzer, which loads spaCy NLP models on first boot and can take minutes to become Ready.
both disabled by default.
values.schema.jsoninput validation,NOTES.txt, ahelm testhookthat curls both
/healthendpoints, and a chartREADME.md.The surrounding sample is updated to stay consistent with the new chart values:
deployment/deploy-presidio.sh— usesimage.registry/image.tag(wasregistry/tag) andadds
--create-namespace.k8s/index.md— correctedhelm installexamples, fixed the Ingress note (the chart no longerenables Ingress by default), and port-forwards the analyzer Service instead of a pod by name.
Validation performed locally:
helm lint --strictpasses.helm templaterenders cleanly for defaults, ingress+HPA enabled, a disabled component, and abare-registry image reference; the schema rejects invalid input (e.g. an unknown ingress
servicekey or a badservice.type).Issue reference
Relates to #1971
Checklist