From 12dffa29779dee83011845af85e6de920065353b Mon Sep 17 00:00:00 2001 From: shimoncohen Date: Sun, 2 Aug 2026 16:50:19 +0300 Subject: [PATCH 1/4] feat(helm): readiness probe, root-CA injection, drop TLS bypass MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a readinessProbe (httpGet / on 8080) so rolling updates and the Route stop sending traffic to pods before the app is up. Replace the blanket NODE_TLS_REJECT_UNAUTHORIZED=0 (disabled all outbound TLS verification) with proper trust: a global.ca block referencing a pre-existing root-ca Secret, mounted into the pod and exported via NODE_EXTRA_CA_CERTS. Gated on global.ca.secretName; set empty to disable. Follows the docker-mapproxy convention. Remove leftover nginx scaffolding (commented volume/volumeMount blocks and the default.conf configmap entry) — this is a Node/SvelteKit app. Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/templates/configmap.yaml | 2 -- helm/templates/deployment.yaml | 33 ++++++++++++++++++++------------- helm/values.yaml | 8 ++++++++ 3 files changed, 28 insertions(+), 15 deletions(-) diff --git a/helm/templates/configmap.yaml b/helm/templates/configmap.yaml index 5272399..678f8d8 100644 --- a/helm/templates/configmap.yaml +++ b/helm/templates/configmap.yaml @@ -5,7 +5,6 @@ kind: ConfigMap metadata: name: {{ .Release.Name }}-{{ $chartName }}-configmap data: - # NODE_TLS_REJECT_UNAUTHORIZED: '0' AWS_ENDPOINT_URL: {{ .Values.s3.url | quote }} AWS_BUCKET: {{ .Values.s3.bucket | quote }} AWS_REGION: {{ .Values.s3.region | quote }} @@ -24,5 +23,4 @@ data: AGENT_ALLOWED_ORIGIN: {{ . | quote }} {{- end }} npm_config_cache: /tmp/ - # default.conf: {{ tpl (.Files.Get "config/default.conf") . | quote }} {{- end }} diff --git a/helm/templates/deployment.yaml b/helm/templates/deployment.yaml index a7b4b04..c594176 100644 --- a/helm/templates/deployment.yaml +++ b/helm/templates/deployment.yaml @@ -55,8 +55,10 @@ spec: env: - name: NODE_OPTIONS value: 'no-network-family-autoselection' - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: '0' + {{- if .Values.global.ca.secretName }} + - name: NODE_EXTRA_CA_CERTS + value: {{ printf "%s/%s" .Values.global.ca.path .Values.global.ca.key | quote }} + {{- end }} envFrom: - configMapRef: name: {{ $releaseName }}-{{ $chartName }}-configmap @@ -75,19 +77,24 @@ spec: httpGet: path: / port: 8080 + readinessProbe: + httpGet: + path: / + port: 8080 {{- if .Values.resources.enabled }} resources: {{- toYaml .Values.resources.value | nindent 12 }} {{- end }} - # volumeMounts: - # - name: nginx-config - # mountPath: /etc/nginx/conf.d/default.conf - # subPath: default.conf - # volumes: - # - name: nginx-config - # configMap: - # name: {{ $releaseName }}-{{ $chartName }}-configmap - # items: - # - key: default.conf - # path: default.conf + {{- if .Values.global.ca.secretName }} + volumeMounts: + - name: root-ca + mountPath: {{ printf "%s/%s" .Values.global.ca.path .Values.global.ca.key | quote }} + subPath: {{ .Values.global.ca.key | quote }} + {{- end }} + {{- if .Values.global.ca.secretName }} + volumes: + - name: root-ca + secret: + secretName: {{ .Values.global.ca.secretName }} + {{- end }} {{- end -}} diff --git a/helm/values.yaml b/helm/values.yaml index 92f348a..b9872b9 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -1,6 +1,14 @@ global: cloudProvider: {} environment: {} + # Root CA injected into the pod for outbound TLS to internal (self-signed) + # endpoints. References a pre-existing Secret (not created by this chart); + # its `key` is mounted at `path` and exported via NODE_EXTRA_CA_CERTS. + # Set secretName to '' to disable injection. + ca: + secretName: 'root-ca' + path: '/usr/local/share/ca-certificates' + key: 'ca.crt' enabled: true environment: development replicaCount: 1 From 4e4ae125a3d920294d75c228fed2d30851c7a07d Mon Sep 17 00:00:00 2001 From: shimoncohen Date: Sun, 2 Aug 2026 16:53:18 +0300 Subject: [PATCH 2/4] feat(helm): add startupProbe, decouple liveness from boot delay Add a startupProbe (httpGet / on 8080) that gates liveness and readiness until the app has booted, giving up to ~5m (30x10s) plus the existing initialDelaySeconds grace. Move initialDelaySeconds onto the startupProbe and drop it from livenessProbe so liveness reacts quickly to hangs once the container is up. Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/templates/deployment.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/helm/templates/deployment.yaml b/helm/templates/deployment.yaml index c594176..b69d566 100644 --- a/helm/templates/deployment.yaml +++ b/helm/templates/deployment.yaml @@ -72,11 +72,17 @@ spec: - name: http containerPort: 8080 protocol: TCP - livenessProbe: + startupProbe: initialDelaySeconds: {{ .Values.initialDelaySeconds }} httpGet: path: / port: 8080 + periodSeconds: 10 + failureThreshold: 30 + livenessProbe: + httpGet: + path: / + port: 8080 readinessProbe: httpGet: path: / From 3875281ba1b48724521f4d2afe0c31086d2b6079 Mon Sep 17 00:00:00 2001 From: shimoncohen Date: Sun, 2 Aug 2026 17:09:30 +0300 Subject: [PATCH 3/4] chore(helm): hardcode CA mount path and key The CA mount path and key never vary; only the source Secret name does. Inline /usr/local/share/ca-certificates/ca.crt and drop global.ca.path / global.ca.key, leaving global.ca.secretName as the sole knob. Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/templates/deployment.yaml | 6 +++--- helm/values.yaml | 8 +++----- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/helm/templates/deployment.yaml b/helm/templates/deployment.yaml index b69d566..873691c 100644 --- a/helm/templates/deployment.yaml +++ b/helm/templates/deployment.yaml @@ -57,7 +57,7 @@ spec: value: 'no-network-family-autoselection' {{- if .Values.global.ca.secretName }} - name: NODE_EXTRA_CA_CERTS - value: {{ printf "%s/%s" .Values.global.ca.path .Values.global.ca.key | quote }} + value: '/usr/local/share/ca-certificates/ca.crt' {{- end }} envFrom: - configMapRef: @@ -94,8 +94,8 @@ spec: {{- if .Values.global.ca.secretName }} volumeMounts: - name: root-ca - mountPath: {{ printf "%s/%s" .Values.global.ca.path .Values.global.ca.key | quote }} - subPath: {{ .Values.global.ca.key | quote }} + mountPath: '/usr/local/share/ca-certificates/ca.crt' + subPath: 'ca.crt' {{- end }} {{- if .Values.global.ca.secretName }} volumes: diff --git a/helm/values.yaml b/helm/values.yaml index b9872b9..03b41a9 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -2,13 +2,11 @@ global: cloudProvider: {} environment: {} # Root CA injected into the pod for outbound TLS to internal (self-signed) - # endpoints. References a pre-existing Secret (not created by this chart); - # its `key` is mounted at `path` and exported via NODE_EXTRA_CA_CERTS. - # Set secretName to '' to disable injection. + # endpoints. References a pre-existing Secret (not created by this chart) + # with a ca.crt key, mounted at /usr/local/share/ca-certificates/ca.crt and + # exported via NODE_EXTRA_CA_CERTS. Set secretName to '' to disable injection. ca: secretName: 'root-ca' - path: '/usr/local/share/ca-certificates' - key: 'ca.crt' enabled: true environment: development replicaCount: 1 From 1345004ad6d4dabcf61c04ba73ead1861d51f480 Mon Sep 17 00:00:00 2001 From: shimoncohen Date: Sun, 2 Aug 2026 17:11:54 +0300 Subject: [PATCH 4/4] docs(helm): trim values comments to the non-obvious Collapse the multi-line explanatory comments to one-liners and drop pure narration, keeping only what isn't clear from the keys themselves: the external-Secret key contracts, the '' toggle semantics, dark-by-default agent, and the proxy origin override. Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/values.yaml | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/helm/values.yaml b/helm/values.yaml index 03b41a9..9798f82 100644 --- a/helm/values.yaml +++ b/helm/values.yaml @@ -1,10 +1,7 @@ global: cloudProvider: {} environment: {} - # Root CA injected into the pod for outbound TLS to internal (self-signed) - # endpoints. References a pre-existing Secret (not created by this chart) - # with a ca.crt key, mounted at /usr/local/share/ca-certificates/ca.crt and - # exported via NODE_EXTRA_CA_CERTS. Set secretName to '' to disable injection. + # Pre-existing Secret (ca.crt key) trusted for outbound TLS; '' disables. ca: secretName: 'root-ca' enabled: true @@ -43,9 +40,7 @@ s3: url: 'http://localhost:9000' bucket: 'temp' region: 'us-east-1' - # Provide credentials via an existing Secret (must expose AWS_ACCESS_KEY_ID and - # AWS_SECRET_ACCESS_KEY). Leave empty to have the chart create the Secret from the - # accessKeyId/secretAccessKey values below. + # Existing Secret with AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY; '' creates one below. existingSecret: '' accessKeyId: 'user' secretAccessKey: 'password' @@ -55,7 +50,6 @@ items: timeout: 600 stale: 600 -# Public navigation links exposed to the browser. links: catalogHref: 'http://catalog' devPortalHref: 'http://developer-portal' @@ -64,17 +58,16 @@ links: cache: debounceMs: 500 -# Agent chat panel (LiteLLM-backed). Dark unless enabled=true. +# Agent chat panel; dark unless enabled. agent: enabled: false model: inclusionai/ling-3.0-flash:free developerPortalUrl: 'http://developer-portal' - # Optional: expected browser Origin for /api/agent behind a proxy. Empty = app origin. + # Override expected browser Origin for /api/agent behind a proxy; '' = app origin. allowedOrigin: '' litellm: baseUrl: 'http://litellm:4000' - # Provide the key via an existing Secret (must expose LITELLM_API_KEY). Leave empty - # to have the chart create the Secret from apiKey below. + # Existing Secret with LITELLM_API_KEY; '' creates one from apiKey below. existingSecret: '' apiKey: ''