Repository navigation
Conversation
Helm chart (deploy/helm/heightproof) - API, worker and dashboard Deployments; optional bundled Postgres and Redis StatefulSets with PVCs, or external URLs. - Secrets generated once and reused across upgrades (lookup), or an existingSecret. - Migrations from infra/migrations (symlinked, single source) applied by an init container under a Postgres advisory lock. - Workers use the pod name as Redis consumer name: the default worker-<pid> is worker-1 in every container, so replicas collided. - Non-root (explicit UID: images use USER node), RuntimeDefault seccomp, read-only root fs, dropped caps, no SA token. - Optional ingress, HPA, PDB; Prometheus scrape annotations; helm test. Production dashboard image: static Vite build on unprivileged nginx that proxies /v1, /ready, /health and the /live WebSocket on the same origin. An empty VITE_HEIGHTPROOF_API_URL now means same-origin. Workflows - kubernetes.yml: chart lint/render, then a kind e2e install that runs helm test and checks events flow API -> Redis -> worker -> Postgres. - release.yml: multi-arch GHCR images with SBOM/provenance on main and tags; chart pushed as an OCI artifact on v* tags. Verified locally on kind (k8s v1.37): all pods ready, helm test passed, 138 seeded events persisted by 2 workers with distinct consumer names. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve the main.tsx conflict by taking main's module split and moving the same-origin apiBase handling into apps/dashboard/src/api.ts. Align the chart with main's readiness rework: /ready now answers 503 and ignores worker backlog, so the API readiness probe uses it; helm test also checks /health/pipeline, which the dashboard nginx now proxies. Verified: typecheck, tests, lint, build, helm lint --strict, and kind e2e (helm test passed, 138 events persisted by 2 workers). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
main already carries this chart via #6. Resolve every conflict to main's version, keeping only the dashboard nginx route for /health/pipeline so the pipeline check is reachable on the dashboard's origin too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
deploy/helm/heightproof): API, worker, dashboard; optional bundled Postgres/Redis StatefulSets or external URLs; secrets generated once and persisted across upgrades; advisory-locked migration init containers sourced frominfra/migrations; hardened pod security; optional ingress/HPA/PDB; Prometheus scrape annotations;helm testsmoke test.infra/dashboard.prod.Dockerfile): static Vite build on unprivileged nginx, proxying/v1,/ready,/healthand the/liveWebSocket on the same origin. An emptyVITE_HEIGHTPROOF_API_URLnow means same-origin; unset keeps the local-dev default.kubernetes.yml(chart lint/render + kind e2e install) andrelease.yml(multi-arch GHCR images with SBOM/provenance; chart pushed as OCI onv*tags).Fixes found while deploying
worker-<pid>, which isworker-1in every container, so replicas collided in the Redis consumer group. The chart sets it to the pod name.USER node, whichrunAsNonRootcan't verify; the chart sets UID 1000 explicitly.Known limitation
The
/liveWebSocket hub is in-process, so with more than one API replica a dashboard only receives pushes for events ingested by its own pod. API defaults to 1 replica; documented in the chart README.Test plan
helm lint --strict, render with default and production-shaped valuesdeploy/kind/e2e.sh: all pods ready,helm testpassed, 138 seeded events persisted API → Redis → worker → Postgres, 2 workers with distinct consumer namesKubernetesworkflow green on this PRReleaseworkflow publishes images after merge🤖 Generated with Claude Code