feat(payments): add helm chart - #233
Merged
Merged
Conversation
Ship a deployment chart for the payments service, mirroring the ledger chart: a read-only-root-filesystem deployment with a /tmp emptyDir, non-root, dropped capabilities, a config map for non-secret env, secretKeyRef injection of the datasource password, Keycloak client secret and webhook HMAC secret from a pre-existing secret, actuator liveness and readiness probes, a v2 autoscaler and a service account. The sandbox bank defaults on (the only provider shipped here) while the dispatcher and retry schedulers default off. Adds the actuator health group config the probes need, and validates the chart in the helm CI matrix. Closes #218
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Final slice of E-02: the production Helm chart for the payments service (
deploy/helm/payments), mirroring the CI-proven ledger chart (#68)./tmpemptyDir (the Add Helm templates ledger-* #68 runtime lesson), non-root (65532), no privilege escalation, drop ALL caps, seccomp RuntimeDefault; actuator/actuator/health/{liveness,readiness}probes; HPA v2 (replicas omitted when autoscaling); image tag defaults to.Chart.AppVersion.secretKeyRefto a configurableexistingSecret, guarded so a barehelm templaterenders valid - no secret values in the chart.sandboxBankEnableddefaults on (the only bank provider shipped here; the orchestrator requires one);dispatcherEnabled/retryEnableddefault off. NOTES warns on an empty secret or a disabled sandbox.server+managementhealth-group block to the paymentsapplication.yml(additive) so the probes resolve (readiness = readinessState,db,liveness = livenessState), plus structured logging and the HTTP request histogram for observability parity.helm-test.ymlbecomes a matrix over[ledger, payments]- both charts linted +helm template | kubeconform -strict.Gates
:services:payments:testgreen. helm/kubeconform on CI. critic GO (sandbox-default-on applied), security-auditor PASS (no secret values, hardened pod security, §5.3 clean, 7/7 ACs), evaluator 0.93.Closes #218