Repository navigation
refactor: the stack runs without one-off containers or default credentials - #414
Merged
Merged
Conversation
…tials base, shared-ca, cert-generator, user-seed and mongo-monitor-user are gone. nginx makes its own self-signed certificate at start unless one is mounted, and the backend serves plain http on 8000 inside the compose network. k3s applies k8s/ (Kueue's release manifest, the namespace and the queues) from its manifests folder, and the worker reads k3s's own kubeconfig. The backend seeds the users and the collector's Mongo user before gunicorn starts. Compose secrets have no defaults: .env comes from .env.example in dev and CI, and the deploy writes it on the server.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
documentation
|
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
…nd over verified HTTPS Kueue only capped what executor pods request (32 CPU, 4Gi), which a ResourceQuota does without a controller, webhooks or CRDs. The worker now creates the namespace and applies executor-quota next to the NetworkPolicy, so k8s/ and its 28k-line manifest are gone, along with every step that linked or mounted it. The backend serves TLS on 443 again, with a self-signed certificate it makes on first start and keeps in the backend_tls_cert volume. nginx mounts that volume read-only and proxies with proxy_ssl_verify on against it.
github-actions
Bot
added
the
area: execution
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every start ran five containers that do one job and exit:
base,shared-ca,cert-generator,user-seedandmongo-monitor-user. cert-generator's Kueue install held the backend and frontend back for up to 300 s (#408). Compose also fell back to public default passwords that the deploy guarded with seven checks.Changes
proxy_ssl_verify on) through a read-only volume.baseis a stage ofbackend/Dockerfile..envcomes from.env.examplein dev and CI, and the deploy writes it on the server.Warning
After the first deploy: run
kubectl delete -f https://github.com/kubernetes-sigs/kueue/releases/download/v0.20.1/manifests.yamlon the server, since Kueue's pod webhook still intercepts every pod while installed. Secrets go into.envsingle-quoted (none may contain'). The old service account and theshared_cavolume stay until removed by hand.Type of Change
Test Plan
cd backend && uv run pytest tests/unit)cd frontend && npm run test)docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')cd frontend && npm run test:e2e)./deploy.sh openapi, then./deploy.sh types), never edited by handValidation: ruff, mypy --strict, 573 backend unit tests, frontend lint, svelte-check and mkdocs --strict pass. On a bare local k3s v1.37.1 the worker created the namespace, policy and quota, an execution through https://localhost:5001 printed "hello from k3s", a 5Gi pod got "exceeded quota", and nginx kept verifying after a backend restart.
Checklist
pre-commit run --all-filesand all checks pass