feat: introduce production-ready Helm chart for chat-service with deployment automation

Introduces Helm chart support for the chat-service microservice and a centralized Makefile for managing deployments across all services, with comprehensive production hardening.

Address #98

Changes Made:
- Created Helm chart for chat-service under helm/chat-service/
- Defined Kubernetes manifests for Deployment, Service, and Helm NOTES.txt
- Introduced values.yaml with configurable ports, replica count, image name, and probes
- Added centralized Makefile with install, upgrade, uninstall, status, and lint for individual charts
- Included install-all, upgrade-all, uninstall-all for batch operations
- Added configurable port-forward target
- Included examples and usage notes via make help
- Added production-ready resource limits (200m CPU, 256Mi memory)
- Configured security hardening (non-root user, read-only filesystem, dropped capabilities)
- Fixed environment variable injection in deployment template
- Enabled autoscaling with realistic limits (2-10 replicas)
- Added comprehensive health checks (startup, liveness, readiness probes)
- Added local image repository setup documentation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: root

helm/LOCAL_IMAGE_REPOSITORY.md

@@ -0,0 +1,199 @@
+# Local Image Repository Setup for Helm Charts
+
+This document explains how to populate and configure local image repositories for OmniPDF Helm charts.
+
+## Overview
+
+OmniPDF Helm charts can work with different types of image repositories:
+- **Public registries** (GitHub Container Registry, Docker Hub)
+- **Local registries** (OpenShift CRC, Harbor, etc.)
+- **Local Docker daemon** (for development)
+
+## Option 1: Using GitHub Container Registry (Recommended)
+
+### Step 1: Pull Images from GHCR
+```bash
+# Pull the required service image
+docker pull ghcr.io/notyusheng/chat_service:dev-v0.0.0-6653136
+docker pull ghcr.io/notyusheng/embedder_service:latest
+# Add other services as needed
+```
+
+### Step 2: Update values.yaml
+Edit `helm/<service-name>/values.yaml`:
+```yaml
+image:
+  repository: ghcr.io/notyusheng/chat_service
+  tag: "dev-v0.0.0-6653136"
+```
+
+### Step 3: Deploy
+```bash
+make install CHART_NAME=chat-service
+```
+
+## Option 2: Using OpenShift CRC Registry
+
+### Prerequisites
+- OpenShift CRC installed and running
+- Access to CRC image registry
+
+### Step 1: Start CRC
+```bash
+crc start
+crc console --credentials  # Get login credentials
+```
+
+### Step 2: Login to Registry
+```bash
+# Login to OpenShift
+oc login -u <username> -p <password> https://api.crc.testing:6443
+
+# Login to image registry
+docker login -u $(oc whoami) -p $(oc whoami -t) default-route-openshift-image-registry.apps-crc.testing
+```
+
+### Step 3: Create Project/Namespace
+```bash
+oc new-project omnipdf
+```
+
+### Step 4: Pull, Tag, and Push Images
+```bash
+# Pull from external registry
+docker pull ghcr.io/notyusheng/chat_service:dev-v0.0.0-6653136
+
+# Tag for CRC registry
+docker tag ghcr.io/notyusheng/chat_service:dev-v0.0.0-6653136 \
+  default-route-openshift-image-registry.apps-crc.testing/omnipdf/chat_service:dev-v0.0.0-6653136
+
+# Push to CRC registry
+docker push default-route-openshift-image-registry.apps-crc.testing/omnipdf/chat_service:dev-v0.0.0-6653136
+```
+
+### Step 5: Update values.yaml
+```yaml
+image:
+  repository: default-route-openshift-image-registry.apps-crc.testing/omnipdf/chat_service
+  pullPolicy: IfNotPresent
+  tag: "dev-v0.0.0-6653136"
+```
+
+## Option 3: Local Docker Daemon (Development Only)
+
+### Step 1: Build Images Locally
+```bash
+# Build from Dockerfile
+cd chat_service/
+docker build -t chat_service:latest .
+```
+
+### Step 2: Update values.yaml
+```yaml
+image:
+  repository: chat_service
+  pullPolicy: Never  # Forces use of local images only
+  tag: "latest"
+```
+
+**Note**: This only works with single-node clusters like Docker Desktop or minikube.
+
+## Option 4: Private Harbor Registry
+
+### Step 1: Setup Harbor Registry
+```bash
+# Install Harbor (example using Docker Compose)
+# Follow Harbor installation guide
+```
+
+### Step 2: Create Project
+- Login to Harbor UI
+- Create project `omnipdf`
+
+### Step 3: Push Images
+```bash
+# Login to Harbor
+docker login harbor.yourdomain.com
+
+# Tag and push
+docker tag ghcr.io/notyusheng/chat_service:dev-v0.0.0-6653136 \
+  harbor.yourdomain.com/omnipdf/chat_service:dev-v0.0.0-6653136
+
+docker push harbor.yourdomain.com/omnipdf/chat_service:dev-v0.0.0-6653136
+```
+
+### Step 4: Update values.yaml
+```yaml
+image:
+  repository: harbor.yourdomain.com/omnipdf/chat_service
+  pullPolicy: IfNotPresent
+  tag: "dev-v0.0.0-6653136"
+
+# If private registry requires authentication
+imagePullSecrets:
+  - name: harbor-registry-secret
+```
+
+### Step 5: Create Image Pull Secret
+```bash
+kubectl create secret docker-registry harbor-registry-secret \
+  --docker-server=harbor.yourdomain.com \
+  --docker-username=<username> \
+  --docker-password=<password> \
+  --docker-email=<email> \
+  -n omnipdf
+```
+
+## Troubleshooting
+
+### ImagePullBackOff Error
+```bash
+# Check pod events
+kubectl describe pod <pod-name> -n omnipdf
+kubectl get events -n omnipdf --sort-by='.lastTimestamp'
+
+# Common causes:
+# 1. Image doesn't exist in registry
+# 2. Authentication required but not configured
+# 3. Network connectivity issues
+# 4. Wrong image tag/repository name
+```
+
+### Registry Authentication Issues
+```bash
+# Test registry connectivity
+docker pull <registry-url>/<image>:<tag>
+
+# Check image pull secrets
+kubectl get secrets -n omnipdf
+kubectl describe secret <secret-name> -n omnipdf
+```
+
+### Image Pull Policy Guidelines
+- `Always`: Always pull the image from registry
+- `IfNotPresent`: Pull only if image doesn't exist locally (default)
+- `Never`: Only use local images, never pull
+
+## Best Practices
+
+1. **Use specific tags** instead of `latest` for production
+2. **Set imagePullPolicy appropriately** based on your deployment strategy
+3. **Use image pull secrets** for private registries
+4. **Verify image exists** in registry before deployment
+5. **Test image pulls** manually before Helm deployment
+
+## Quick Commands
+
+```bash
+# Check current image configuration
+helm get values chat-service -n omnipdf
+
+# List available images in local Docker
+docker images | grep chat_service
+
+# Check pod image and status
+kubectl describe pod -n omnipdf -l "app.kubernetes.io/name=chat-service"
+
+# Update deployment with new image
+make upgrade CHART_NAME=chat-service
+```

helm/chat-service/templates/deployment.yaml

@@ -46,6 +46,10 @@ spec:
             {{- toYaml .Values.readinessProbe | nindent 12 }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.env }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- with .Values.volumeMounts }}
           volumeMounts:
             {{- toYaml . | nindent 12 }}

helm/chat-service/values.yaml

@@ -3,13 +3,11 @@
 # Declare variables to be passed into your templates.
 
 # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
-replicaCount: 1
+replicaCount: 2
 
 # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
 image:
-  repository: default-route-openshift-image-registry.apps-crc.testing/omnipdf/chat_service
-  # This sets the pull policy for images.
-  pullPolicy: IfNotPresent
+  repository: ghcr.io/notyusheng/chat_service
   # Overrides the image tag whose default is the chart appVersion.
   tag: "dev-v0.0.0-6653136"
 
@@ -41,13 +39,14 @@ podLabels: {}
 podSecurityContext: {}
   # fsGroup: 2000
 
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+securityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  runAsUser: 65534
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop:
+      - ALL
 
 # This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
 service:
@@ -73,35 +72,45 @@ ingress:
   #    hosts:
   #      - chart-example.local
 
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
+resources:
+  limits:
+    cpu: 200m
+    memory: 256Mi
+  requests:
+    cpu: 50m
+    memory: 64Mi
 
 # This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+startupProbe:
+  httpGet:
+    path: /health
+    port: 8000
+  initialDelaySeconds: 10
+  periodSeconds: 5
+  timeoutSeconds: 3
+  failureThreshold: 6
 livenessProbe:
   httpGet:
     path: /health
     port: 8000
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
 readinessProbe:
   httpGet:
     path: /health
     port: 8000
+  periodSeconds: 10
+  timeoutSeconds: 3
+  failureThreshold: 2
 
 #This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
 autoscaling:
-  enabled: false
-  minReplicas: 1
-  maxReplicas: 100
-  targetCPUUtilizationPercentage: 80
-  # targetMemoryUtilizationPercentage: 80
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
 
 # Additional volumes on the output Deployment definition.
 volumes: []
@@ -124,15 +133,11 @@ affinity: {}
 
 env:
   - name: OPENAI_BASE_URL
-    value: http://vllm-qwen:1234/v1
+    value: http://webworkdgx/vllm_qwen2.5/v1
+  - name: OPENAI_API_KEY
+    value: lm-studio
   - name: OPENAI_MODEL
     value: qwen2.5-0.5b-instruct
 
-# Secret-based API key config
-apiKeySecret:
-  enabled: true
-  name: openai-api-key-secret
-  key: OPENAI_API_KEY
-
 #istio:
 #  enabled: true