Skip to content

fix: Update Helm chart configuration for console deployment - #663

Draft
nbmaiti wants to merge 6 commits into
mainfrom
fix/console_k8s_working
Draft

nbmaiti wants to merge 6 commits into
mainfrom
fix/console_k8s_working

Conversation

@nbmaiti

@nbmaiti nbmaiti commented Aug 27, 2026

Copy link
Copy Markdown

Fixes #664

Issues Addressed

  1. Hardcoded Namespaces: Explicit namespace: default in manifests prevents flexible multi-namespace deployments
  2. Outdated Environment Variables: Old CONSOLE_* prefixed variables don't match current application configuration schema
  3. Service Discovery: Incorrect service references (mps → console, wrong KUMA annotation) cause routing failures
  4. Health Check Mismatch: /api/v1/health endpoint doesn't exist; should use /healthz
  5. Web UI Configuration: Missing SPA routing fallback; hardcoded service names prevent multi-environment deployments
  6. Code Quality: Trailing whitespace in YAML files

Solutions Implemented

Issue Solution
Hardcoded namespaces Removed explicit namespace: default to inherit from Helm release context
Environment variables Reorganized into logical groups: APP_*, AUTH_*, HTTP_*, DB_*, SECRETS_*
Service references Updated mpsrouter KUMA annotation to console_{{ .Release.Namespace }}_svc_3000; fixed RPS_MPS_SERVER to point to console
Health check Changed readinessProbe path from /api/v1/health to /healthz
Web UI routing Added try_files $uri $uri/ /index.html; for SPA support; replaced hardcoded commonName with {{ .Values.gateway.publicUrl }}
Code quality Removed all trailing whitespace from YAML files

Changes

  • console.yaml: Updated environment variables, health check, and removed namespace
  • kong.yaml: Removed hardcoded namespaces from all Ingress resources
  • mpsrouter.yaml: Fixed KUMA annotation with proper namespace template
  • rps.yaml: Updated MPS server endpoint reference
  • webui.yaml: Enhanced nginx config for SPA routing; added gateway.publicUrl variable
  • values.yaml: Added new gateway.publicUrl configuration option

Testing Checklist

  • Verify pod health checks pass in test environment
  • Test service-to-service communication (console ↔ rps, rps ↔ mpsrouter)
  • Validate web UI routing works correctly in multi-namespace setup
  • Confirm all environment variables are correctly injected and accessible
  • Check KUMA service mesh annotation resolves correctly

@nbmaiti
nbmaiti force-pushed the fix/console_k8s_working branch from 0522494 to e79b541 Compare August 27, 2026 03:33
@nbmaiti
nbmaiti marked this pull request as draft August 27, 2026 03:33
@nbmaiti nbmaiti changed the title Update Helm chart configuration for console deployment fix: Update Helm chart configuration for console deployment Aug 27, 2026
@nbmaiti
nbmaiti requested a lite review from Copilot August 27, 2026 03:35

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Helm chart templates to make console-related deployments more environment- and namespace-friendly, aligning service discovery, health checks, and web UI configuration with the current runtime expectations.

Changes:

  • Removed hardcoded namespace: default to rely on the Helm release namespace.
  • Updated routing/service references (RPS → console, Kuma direct-access service name) and fixed console readiness probe path to /healthz.
  • Improved web UI nginx SPA routing and introduced gateway.publicUrl for externally-reachable API base URLs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
charts/values.yaml Adds new gateway.publicUrl configuration knob for browser-facing host configuration.
charts/templates/webui.yaml Adds SPA try_files fallback and switches API URL env vars to gateway.publicUrl.
charts/templates/rps.yaml Removes hardcoded namespace and repoints RPS_MPS_SERVER to the console service.
charts/templates/mpsrouter.yaml Removes hardcoded namespace and fixes Kuma direct-access service annotation to be namespace-aware.
charts/templates/kong.yaml Removes hardcoded namespaces and cleans up YAML formatting/whitespace.
charts/templates/console.yaml Removes hardcoded namespace, updates readiness probe path, and replaces legacy CONSOLE_* env vars with new grouped configuration.
chart-fixes.diff Adds a patch artifact file mirroring the PR changes.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread charts/templates/webui.yaml Outdated
Comment on lines +77 to +81
env:
- name: "MPS_SERVER"
value: "https://{{.Values.console.commonName}}/mps"
value: "https://{{ .Values.gateway.publicUrl }}/mps"
- name: "RPS_SERVER"
value: "https://{{.Values.console.commonName}}/rps"
value: "https://{{ .Values.gateway.publicUrl }}/rps"
Comment on lines +54 to +58
- name: "APP_ENCRYPTION_KEY"
valueFrom:
secretKeyRef:
name: console
key: appEncryptionKey
Comment thread chart-fixes.diff Outdated
Comment on lines +1 to +5
diff --git a/charts/templates/console.yaml b/charts/templates/console.yaml
--- a/charts/templates/console.yaml 2026-08-27 08:14:25.235265906 +0530
+++ b/charts/templates/console.yaml 2026-08-27 08:14:25.231152706 +0530
@@ -26,7 +26,6 @@
kind: Deployment
@nbmaiti
nbmaiti force-pushed the fix/console_k8s_working branch 2 times, most recently from 9832aa2 to 88a6bb2 Compare August 27, 2026 05:45
@nbmaiti
nbmaiti force-pushed the fix/console_k8s_working branch 2 times, most recently from 3168243 to e54f453 Compare September 8, 2026 15:13
- Remove explicit namespace defaults to use Helm release namespace
- Update console health check endpoint to /healthz
- Rename environment variables to match new application configuration:
  - CONSOLE_* prefixed vars → APP_* or AUTH_* based on purpose
  - HTTP_*, LOG_LEVEL, DB_* for infrastructure settings
  - SECRETS_* for vault configuration
- Add new environment variables: APP_ENCRYPTION_KEY, APP_DISABLE_CIRA
- Update mpsrouter to reference console service with proper namespace template
- Fix RPS_MPS_SERVER to point to console instead of mps
- Update webui nginx configuration for SPA routing with try_files
- Use gateway.publicUrl for web UI API endpoints
- Fix lint issues: remove trailing whitespace

Signed-off-by: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
- webui: fall back to console.commonName when gateway.publicUrl is unset
  instead of rendering "https://<no value>/mps". Both are resolved through a
  new installServersChart.publicUrl helper that fails with a clear message
  when neither is set and webui is enabled.
- secrets: define the console and consoleweb Secrets in charts/secrets.yaml.
  Both were already referenced by console.yaml but never provisioned; this
  also documents the newly required appEncryptionKey (32 chars, AES-256).
- Remove chart-fixes.diff, an intermediate patch artifact that should not
  have been committed.

Signed-off-by: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
values-cloud.yaml enables webui but didn't set gateway.publicUrl or
console.commonName, causing helm template to fail. Added a placeholder
default to gateway.publicUrl in values-cloud.yaml, and simplified the
helper to just use the fallback logic without strict validation (the
values files now provide sensible defaults/placeholders).

Verified:
- helm template console charts -f charts/values-cloud.yaml ✓
- helm lint ✓
- Fallback to console.commonName still works when publicUrl not set ✓

Signed-off-by: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
@nbmaiti
nbmaiti force-pushed the fix/console_k8s_working branch from e54f453 to 69ad088 Compare September 17, 2026 06:38
rps still fetches a 'MPSCerts' secret from Vault during CIRA/TLS
activation (activation.ts fetchMPSRootKey), a leftover from the old
standalone mps microservice that used to create it on startup. console
replaces mps but never writes it, so nothing in this chart creates it
anymore and rps activation fails with 'Failed to fetch MPS root key
from vault'.

Add a post-install/post-upgrade Helm hook Job to rps.yaml (the file
already gated on .Values.rps.enabled, and rps is the only consumer of
this secret). Generates the root cert with Vault's own pki secrets
engine (pki-mpscerts, generate/exported, then disabled again) rather
than openssl, so the Job needs only the hashicorp/vault image already
pulled for the Vault pod itself and no outbound internet access at all
— an earlier openssl-in-an-alpine-initContainer version hung
indefinitely fetching Alpine's package mirrors behind a corporate
proxy, and Helm waits synchronously for hook Jobs regardless of --wait.
Skips if the secret already exists; survives helm upgrade/rollback.

Signed-off-by: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
@nbmaiti
nbmaiti force-pushed the fix/console_k8s_working branch from 69ad088 to 27f42e8 Compare September 17, 2026 07:41
…t.pem

console's LoadOrGenerateRootCertificateWithVault loads a Vault-stored
root cert into memory fine on startup, but never writes it back to
disk. The separate /api/v1/ciracert HTTP handler reads
config/root_cert.pem directly from disk, so on any pod restart with no
persistent volume (this chart mounts none) it 500s with 'failed to
read certificate file' even though Vault has a perfectly good cert.

Extend the seed-mps-certs Job (with its own ServiceAccount/Role/
RoleBinding) to also generate a console root cert via Vault's pki
engine and create a 'console-root-cert' k8s Secret from it via the
Kubernetes API (busybox wget + the Job's own ServiceAccount token,
since the vault image has no kubectl). Mount that Secret in
console.yaml at /config/root_cert.pem, read-only.

Signed-off-by: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
BusyBox wget in hashicorp/vault does not support --ca-certificate, so
the hook never reached the Kubernetes API. Its error was swallowed with
'|| true', causing Helm to delete the hook as successful while console
remained stuck mounting a nonexistent console-root-cert Secret.

Use SSL_CERT_FILE with the mounted ServiceAccount CA, check whether the
Secret exists before posting it, and fail the hook on transport/API or
response validation errors. Verified by upgrading the live release:
console-root-cert was created and console reached Running 1/1.

Signed-off-by: Nabendu Maiti <nabendu.bikash.maiti@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Console deployment fails on k3s/Kubernetes

2 participants