chore(helm): expose SPIFFE values; migrate env values files to house naming - #72
Merged
Merged
Conversation
…naming
Task 1 — SPIFFE:
- values.yaml: add spiffe.{enabled,trustDomain,xfccHeader} (default off),
matching the real env vars manager/backend/app/config.py reads
(SPIFFE_ENABLED/SPIFFE_TRUST_DOMAIN/SPIFFE_XFCC_HEADER). manager is the
only service that reads them (grep across dns-server/app and
manager/backend/app confirmed no other consumer; manager-scheduler runs
supercronic cron jobs only, never the inbound XFCC auth path in
middleware/auth.py, so it's intentionally left unwired).
- manager-deployment.yml: render SPIFFE_ENABLED/SPIFFE_TRUST_DOMAIN/
SPIFFE_XFCC_HEADER only when spiffe.enabled is true (omit entirely when
false) — config.py already defaults SPIFFE_ENABLED to "false" when the
var is unset, so omission and an explicit "false" are behaviorally
identical; omitting keeps the manifest clean when the feature is off.
- k8s/helm/spire/README.md: replace the interim `kubectl set env` step
with the values-based flow (values file or `--set spiffe.enabled=true`).
Task 2 — values file naming migration:
- git mv values-beta.yml -> beta.yml, values-prod.yml -> production.yml.
- Deleted k8s/helm/squawk/values.yml: stray duplicate of values.yaml,
missing the manager/jwt/networkPolicy/pdb/autoscaling/spiffe blocks added
since — Helm never auto-loads *.yml (only values.yaml), and no
script/workflow referenced it. Confirmed dead via repo-wide grep.
- Added alpha.yml: localhost:32000 registry, alpha-latest tags,
IfNotPresent pull policy, 1 replica, minimal resources, autoscaling off,
and NodePort exposure with fixed ports (dns-server 30080, squawk-client
30053, dhcp-server 30081, ntp-server 30082/30446/30123 for
http/nts-ke/ntp-udp). Scoped NodePort to the services meant to be reached
from localhost directly; k8s-dns (in-cluster CoreDNS target only),
valkey, and manager stay ClusterIP per their existing NetworkPolicy
intent. Required templating `service.type`/`nodePort` (previously
hardcoded ClusterIP) into dns-server/dhcp-server/ntp-server/squawk-client
Service templates, and `image.pullPolicy` (previously hardcoded Always)
into dns-server/squawk-client/k8s-dns Deployments — dhcp-server/
ntp-server/manager were already IfNotPresent unconditionally.
- Added gamma.yml: mirrors the beta.yml tier (1 replica, minimal
resources) per the house standard. Used tag: latest rather than a
gamma-<epoch64> tag since there's no real CI-built gamma image yet to
reference (unlike beta.yml's dnsServer, which carries a real historical
epoch) — CI/deploy tooling should `--set` the actual tag at deploy time.
- Updated scripts/deploy-beta.sh: values-beta.yaml -> beta.yml (this
reference was already stale — the file was values-beta.yml, not .yaml).
- docs/standards/KUBERNETES.md and docs/standards/ARCHITECTURE.md still
show values-beta.yaml/values-prod.yaml — left untouched, these are
centralized template files this repo's CLAUDE.md forbids editing.
Validated: helm lint + helm template (all 4 env files, plus
--set spiffe.enabled=true on each) all pass clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @PenguinzTech, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
PenguinzTech
added a commit
that referenced
this pull request
Jul 27, 2026
Process error: after merging #74 (SSO) into v2.1.x, I deleted my LOCAL feature/sso-oidc-login branch ref but never deleted or retargeted the REMOTE branch/PR. #76 (SAML)'s base silently remained feature/sso-oidc-login instead of v2.1.x, so `gh pr merge 76` merged SAML into that orphaned remote branch -- completely disconnected from v2.1.x. GitHub still shows PR #76 as MERGED, but v2.1.x itself never received any of it (confirmed: alembic versions/ was missing 012_add_saml_providers.py and 013_add_saml_assertion_ids.py entirely). Nothing was lost -- the fully-resolved SAML merge commit (d7ffab1, carrying all of #76's conflict resolution work) still existed on the orphaned branch. Merged it into the actual v2.1.x tip here: clean, no conflicts (SAML's changes are manager/backend-only; v2.1.x's only change since d7ffab1's parent was #72's Helm-only work). Verified: 19 alembic migrations, single linear head (013_add_saml_assertion_ids). Full manager suite: 361/361 passing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the gap documented in #64's SPIRE README:
spiffe.{enabled,trustDomain,xfccHeader}now exposed as chart values (wired to the real env vars the manager reads; env block omitted entirely when disabled), README updated to the values-based flow. Also migrates env values files to house naming:values-beta.yml→beta.yml,values-prod.yml→production.yml, newalpha.yml(NodePort + localhost:32000 + minimal resources) andgamma.yml(beta tier); deleted stale never-loadedvalues.yml; service type/nodePort and imagePullPolicy templated to support alpha; fixed the stale reference in scripts/deploy-beta.sh.Validation: helm lint clean; helm template green for all four env files, each also with
--set spiffe.enabled=true.Not touched:
docs/standards/*.mdstill reference old filenames — those files are centrally managed and off-limits per repo policy; flagging for the standards repo.Stack note: Part 2 of the Helm stack — depends on #64 (
chore/helm-pdb-hpa-spire); auto-retargets as the stack merges.🤖 Generated with Claude Code