feat(platform): Helm chart replacing Kustomize base+overlays - #10
Open
1456055067 wants to merge 4 commits into
Open
feat(platform): Helm chart replacing Kustomize base+overlays#101456055067 wants to merge 4 commits into
1456055067 wants to merge 4 commits into
Conversation
Package the full WinDep control plane (windep-api, windep-web deploy server,
windep-admin) + Cilium anycast LB/BGP as a single values-driven Helm chart at
platform/windep, and remove the Kustomize base/overlays/components.
- Per-site values (values-k3s.yaml, values-example.yaml) replace vars.yaml +
the admin-netpol-patch + the images: transformer. Parity preserved: the
windep.dev/lb-anycast label + io.cilium/lb-ipam-ips annotation, the api->admin
NetworkPolicy ingest rule, admin ETP=Local/Recreate, api ClusterIP.
- networking.mode toggles CiliumBGPAdvertisement (bgp) vs CiliumL2AnnouncementPolicy (l2).
- TLS via cert-manager ACME (certManager.enabled): namespaced/Cluster Issuer +
a Certificate per service into the windep-{api,web,admin}-tls secrets the
workloads already mount. ACME server must be the internal CA so certs chain to
the root baked into boot.wim; DNS-01/HTTP-01 solvers only (cert-manager has no
TLS-ALPN-01). certManager.enabled=false falls back to pre-created TLS secrets.
- Rewrite platform/README.md for the Helm workflow (prereqs, secrets, cert-manager,
k3s Cilium install, values reference); network-boot/DHCP still in Server/README.md.
Verified with helm lint + helm template (both value files) and mode/feature toggles.
…ues.yaml Establish the platform/sites/<site>/values.yaml convention with an 'example' site (full-k8s, BGP). Override-only file merged over the chart defaults.
Document both DNS-01 (active rfc2136 stub) and HTTP-01 (ingress) ACME solvers in values.yaml, with the ingress-controller/:80 caveat; note both in the README.
… CVE) govulncheck (@latest DB) flags a Go 1.25.11 standard-library vulnerability that started failing CI on every branch after main's last green run. Bump the go directive in both modules and the Iron Bank builder image to 1.26.5-alpine. Verified: go build + govulncheck report no vulnerabilities for api and admin.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the Kustomize base + overlays with a single values-driven Helm chart at
platform/windepthat deploys the whole WinDep control plane —windep-api, thewindep-webdeploy server (serves/boot/images/config, proxies/api/*), andwindep-admin— plus Cilium anycast LB/BGP and optional cert-manager TLS.Motivation: the server side wasn't deployed anywhere reachable, blocking a live E2E deploy
test. A chart gives one
helm install -f values-<site>.yamlper site.Layout
Parity with the old Kustomize (preserved verbatim)
windep.dev/lb-anycastlabel +io.cilium/lb-ipam-ipsannotation (LB pool + advert select on them).windep-adminNetworkPolicy keeps both theadmin.allowedCIDRsipBlock list and theapp: windep-apiingest rule.ClusterIP; web/adminLoadBalancer; adminexternalTrafficPolicy: Local,strategy: Recreate, 1 replica.automountServiceAccountToken: false, topologySpread.checksum/configso edits roll the pods).New knobs (replace vars.yaml + patches +
images:)web.vip/admin.vip,networking.{lbPoolCIDR,advertiseGroup,mode},admin.allowedCIDRs,storage.*,images.*.tag.networking.mode: bgp|l2togglesCiliumBGPAdvertisementvsCiliumL2AnnouncementPolicy.images:block).TLS — cert-manager ACME
certManager.enabledrenders an ACMEIssuer/ClusterIssuer+ aCertificateper serviceinto the
windep-{api,web,admin}-tlssecrets the workloads mount (auto-renew, no app change).Verification
helm lint+helm templateclean for both value files.mode=l2renders L2 + drops BGP;certManager.enabled=falsedrops Issuer/Certificate;api.hpa.enabled=falseputsreplicasback on the Deployment.Notes / follow-ups
api.policyUrl).kubectl-based cluster dry-run not run here (site endpoints don't resolve from the dev box).