Skip to content

Commit 591b62f

Browse files
haasonsaashaasonsaas
committed
chore(helm): add ci lint and optional resources
1 parent fbcc71d commit 591b62f

File tree

9 files changed

+184
-1
lines changed

9 files changed

+184
-1
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,27 @@ env:
99
UV_LINK_MODE: copy
1010

1111
jobs:
12+
helm:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v4
17+
18+
- name: Set up Helm
19+
uses: azure/setup-helm@v3
20+
21+
- name: Helm lint
22+
run: make helm-lint
23+
24+
- name: Helm template (defaults)
25+
run: make helm-template
26+
27+
- name: Helm template (external Redis)
28+
run: >
29+
helm template provenance charts/provenance
30+
--set redis.enabled=false
31+
--set env.PROVENANCE_REDIS_URL='redis://external-redis:6379/0'
32+
1233
test:
1334
runs-on: ubuntu-latest
1435
steps:

‎Makefile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
.PHONY: setup test compile run docs dashboard clickhouse-up
2+
.PHONY: helm-lint helm-template helm-package
23

34
setup:
45
uv sync --all-extras
@@ -22,3 +23,13 @@ clickhouse-up:
2223
docker run --rm -p 8123:8123 -p 9000:9000 \
2324
-v $(PWD)/infrastructure/clickhouse/schema.sql:/docker-entrypoint-initdb.d/schema.sql \
2425
clickhouse/clickhouse-server:latest
26+
27+
helm-lint:
28+
helm lint charts/provenance
29+
30+
helm-template:
31+
helm template provenance charts/provenance
32+
33+
helm-package:
34+
mkdir -p dist/charts
35+
helm package charts/provenance --destination dist/charts

‎charts/provenance/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: provenance
3-
version: 0.2.0
3+
version: 0.3.0
44
appVersion: "0.1.0"
55
description: Helm chart for Provenance & Risk Analytics service
66
type: application

‎charts/provenance/README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ Common overrides:
3636
| `ingress.*` | Ingress configuration (class, hosts, TLS) | Disabled |
3737
| `redis.enabled` | Deploy bundled Redis | `true` |
3838
| `redis.persistence.enabled` | Provision PVC for Redis data | `false` |
39+
| `serviceMonitor.enabled` | Emit a ServiceMonitor for Prometheus Operator | `false` |
40+
| `pdb.enabled` | Create PodDisruptionBudget for API pods | `false` |
41+
| `networkPolicy.enabled` | Restrict pod ingress/egress with NetworkPolicy | `false` |
3942

4043
See [`values.yaml`](values.yaml) for the full catalog (node selectors, tolerations, OTEL knobs, extra volumes, etc.).
4144

@@ -44,3 +47,26 @@ See [`values.yaml`](values.yaml) for the full catalog (node selectors, toleratio
4447
- When enabling Redis persistence, ensure an appropriate storage class exists.
4548
- Provide signing keys and API tokens via `extraEnvFrom` referencing Kubernetes Secrets.
4649
- Enable autoscaling by toggling `autoscaling.enabled` and configuring min/max replicas and CPU utilization targets.
50+
51+
## Packaging & Publishing
52+
53+
Package the chart locally:
54+
55+
```bash
56+
make helm-package
57+
# outputs dist/charts/provenance-<version>.tgz
58+
```
59+
60+
To publish via GitHub Pages or an OCI registry:
61+
62+
```bash
63+
helm package charts/provenance --destination dist/charts
64+
helm repo index dist/charts --url https://example.com/charts
65+
```
66+
67+
Or push to an OCI registry:
68+
69+
```bash
70+
helm package charts/provenance
71+
helm push provenance-<version>.tgz oci://ghcr.io/your-org/charts
72+
```

‎charts/provenance/templates/networkpolicy.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{- if .Values.networkPolicy.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ include "provenance.fullname" . }}
6+
labels:
7+
{{- include "provenance.labels" . | nindent 4 }}
8+
spec:
9+
podSelector:
10+
matchLabels:
11+
{{- include "provenance.selectorLabels" . | nindent 6 }}
12+
policyTypes:
13+
{{- range .Values.networkPolicy.policyTypes }}
14+
- {{ . }}
15+
{{- end }}
16+
{{- if .Values.networkPolicy.ingress }}
17+
ingress:
18+
{{- toYaml .Values.networkPolicy.ingress | nindent 4 }}
19+
{{- end }}
20+
{{- if .Values.networkPolicy.egress }}
21+
egress:
22+
{{- toYaml .Values.networkPolicy.egress | nindent 4 }}
23+
{{- end }}
24+
{{- end }}

‎charts/provenance/templates/pdb.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if .Values.pdb.enabled }}
2+
apiVersion: policy/v1
3+
kind: PodDisruptionBudget
4+
metadata:
5+
name: {{ include "provenance.fullname" . }}
6+
labels:
7+
{{- include "provenance.labels" . | nindent 4 }}
8+
spec:
9+
{{- if .Values.pdb.maxUnavailable }}
10+
maxUnavailable: {{ .Values.pdb.maxUnavailable }}
11+
{{- else }}
12+
minAvailable: {{ .Values.pdb.minAvailable }}
13+
{{- end }}
14+
selector:
15+
matchLabels:
16+
{{- include "provenance.selectorLabels" . | nindent 6 }}
17+
{{- end }}

‎charts/provenance/templates/servicemonitor.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{{- if .Values.serviceMonitor.enabled }}
2+
apiVersion: monitoring.coreos.com/v1
3+
kind: ServiceMonitor
4+
metadata:
5+
name: {{ include "provenance.fullname" . }}
6+
labels:
7+
{{- include "provenance.labels" . | nindent 4 }}
8+
{{- with .Values.serviceMonitor.labels }}
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
{{- with .Values.serviceMonitor.annotations }}
12+
annotations:
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- if .Values.serviceMonitor.namespace }}
16+
namespace: {{ .Values.serviceMonitor.namespace }}
17+
{{- end }}
18+
spec:
19+
selector:
20+
matchLabels:
21+
{{- include "provenance.selectorLabels" . | nindent 6 }}
22+
endpoints:
23+
- port: http
24+
path: {{ .Values.serviceMonitor.path }}
25+
interval: {{ .Values.serviceMonitor.interval }}
26+
{{- if .Values.serviceMonitor.scrapeTimeout }}
27+
scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
28+
{{- end }}
29+
scheme: {{ .Values.serviceMonitor.scheme }}
30+
{{- with .Values.serviceMonitor.tlsConfig }}
31+
tlsConfig:
32+
{{- toYaml . | nindent 8 }}
33+
{{- end }}
34+
{{- with .Values.serviceMonitor.metricRelabelings }}
35+
metricRelabelings:
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
{{- with .Values.serviceMonitor.relabelings }}
39+
relabelings:
40+
{{- toYaml . | nindent 8 }}
41+
{{- end }}
42+
namespaceSelector:
43+
matchNames:
44+
- {{ default .Release.Namespace .Values.serviceMonitor.namespace }}
45+
{{- end }}

‎charts/provenance/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,35 @@ ingress:
9494
- path: /
9595
pathType: Prefix
9696
tls: []
97+
98+
serviceMonitor:
99+
enabled: false
100+
namespace: ""
101+
labels: {}
102+
annotations: {}
103+
interval: 30s
104+
scrapeTimeout: ""
105+
path: /metrics
106+
scheme: http
107+
tlsConfig: {}
108+
metricRelabelings: []
109+
relabelings: []
110+
111+
pdb:
112+
enabled: false
113+
minAvailable: 1
114+
maxUnavailable: ""
115+
116+
networkPolicy:
117+
enabled: false
118+
policyTypes:
119+
- Ingress
120+
- Egress
121+
ingress:
122+
- from:
123+
- podSelector: {}
124+
ports:
125+
- protocol: TCP
126+
port: 8000
127+
egress:
128+
- {}

‎docs/deployment-guide.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,13 @@ spec:
129129
- Expose the API via an ingress controller (NGINX, Traefik, ALB).
130130
- Terminate TLS at the ingress or use a service mesh (Linkerd, Istio). Ensure `PROVENANCE_SERVICE_BASE_URL` matches the external HTTPS endpoint.
131131

132+
### Helm Packaging & Release
133+
134+
- Run `make helm-lint` and `make helm-template` (or rely on CI) before cutting releases.
135+
- Package the chart with `make helm-package`; artifacts land in `dist/charts/provenance-<version>.tgz`.
136+
- Publish to GitHub Pages (`helm repo index dist/charts --url ...`) or push to an OCI registry (`helm push provenance-<version>.tgz oci://ghcr.io/<org>/charts`).
137+
- Remember to bump `charts/provenance/Chart.yaml` when chart features change.
138+
132139
## Scaling Considerations
133140

134141
- **Detector Throughput** – Detector execution happens synchronously per request. Increase pod count to parallelize analyses, or shard workflows by repo/team. Monitoring request latency via Prometheus helps identify bottlenecks.

0 commit comments

Comments
 (0)