feat(infra): add ledger helm chart with lint and kubeconform ci - #147
Merged
Conversation
Service chart deploy/helm/ledger with Deployment (liveness/readiness probes on 8080, distroless nonroot securityContext, read-only root fs with a /tmp emptyDir, resource requests/limits), ClusterIP Service, autoscaling/v2 HPA (min 1, max 10, cpu 70 percent), and a ConfigMap for non-secret config. Secrets are referenced from an existing Kubernetes Secret via secretKeyRef, never templated. Rewires the helm-test workflow to helm lint plus helm template piped to a pinned kubeconform, dropping the kind install that cannot pull the unpushed image. Closes #68
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A Helm chart packaging the ledger service for Kubernetes, plus a working validation workflow, closing the Epic E-01 deployment-packaging criterion.
deploy/helm/ledger: Deployment, Service (ClusterIP), HorizontalPodAutoscaler (autoscaling/v2, min 1 / max 10 / CPU 70%), ConfigMap (non-secret env), ServiceAccount, plus_helpers.tplandNOTES.txt./actuator/health/liveness,/readiness) on the 8080 http port, sets resource requests/limits (250m/512Mi .. 1000m/1Gi), and a hardened securityContext matching the distroless image (runAsNonRoot uid 65532, drop ALL caps,readOnlyRootFilesystem: true)./tmpemptyDir: Spring Boot's embedded Tomcat writes its work dir underjava.io.tmpdir, so a read-only root without a writable/tmpwould CrashLoopBackOff. The chart mounts anemptyDirat/tmp.secretKeyReffrom an operator-providedexistingSecret; the chart never contains secret values and the secret-env block is guarded so a bare render stays valid.CI
Rewires
.github/workflows/helm-test.yml:helm lint+helm template --set image.tag=test | kubeconform -strict -kubernetes-version 1.31.0(pinned kubeconform v0.6.7). Drops the previousct installon kind and thefincore-engineumbrella render: the image is never pushed to GHCR (forbidden), so a live kind install would ImagePullBackOff, and there is no umbrella chart. The issue ACs require lint + template + static validation, not a live install.Notes
Infra/YAML only, no Kotlin. Probes default to the 8080 port, so the chart keeps
SPRING_PROFILES_ACTIVEempty (the prod profile moves actuator to 9090); documented in values.yaml. Gate chain: analyst, architect, critic (GO-WITH-CHANGES, /tmp volume + replicas-omit + HPA-shape + kubeconform-version-pin folded).Closes #68