Deployment: Kubernetes Helm chart + admin docs

.github/workflows/dev.yml

@@ -79,6 +79,8 @@ jobs:
     secrets: inherit
   quality-clients:
     uses: ./.github/workflows/quality-clients.yml
+  quality-chart:
+    uses: ./.github/workflows/quality-chart.yml
   e2e-tests:
     needs: [quality-servers, quality-clients]
     uses: ./.github/workflows/test-e2e.yml

.github/workflows/quality-chart.yml

@@ -0,0 +1,39 @@
+name: Quality Helm Chart
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  quality-chart:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: azure/setup-helm@v4
+      - name: Lint chart
+        run: helm lint charts/prompt -f charts/prompt/ci/default-values.yaml
+      - name: Install kubeconform
+        run: |
+          curl -sSL -o /tmp/kubeconform.tar.gz \
+            https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-linux-amd64.tar.gz
+          tar -xzf /tmp/kubeconform.tar.gz -C /tmp kubeconform
+          sudo install /tmp/kubeconform /usr/local/bin/kubeconform
+      - name: Validate rendered manifests
+        # -ignore-missing-schemas skips resources with no published schema, which
+        # means the CloudNativePG, Keycloak and Envoy Gateway custom resources are
+        # NOT field-validated here. Only core Kubernetes objects are.
+        run: |
+          for values in charts/prompt/ci/*-values.yaml; do
+            echo "::group::kubeconform $(basename "$values")"
+            helm template prompt charts/prompt -f "$values" |
+              kubeconform -strict -ignore-missing-schemas -summary -
+            echo "::endgroup::"
+          done
+      - name: Assert render properties
+        # Renders every mode combination and checks the properties a regression
+        # would silently break. Cannot cover anything the kubelet decides at
+        # container start; see docs/admin/kubernetes/installation.md.
+        run: charts/prompt/ci/assert-render.sh

.pre-commit-config.yaml

@@ -16,6 +16,10 @@ repos:
       - id: check-merge-conflict
       - id: check-yaml
         args: [--allow-multiple-documents]
+        # Helm templates are Go templates, not YAML. `helm lint` and the render
+        # gate in quality-chart.yml validate those. values/Chart/ci files stay
+        # checked here because they are plain YAML.
+        exclude: '^charts/.*/templates/.*\.ya?ml$'
       - id: check-json
         # tsconfig files are JSONC (comments/trailing commas), not strict JSON.
         exclude: '(^|/)(tsconfig[^/]*\.json|.*\.jsonc)$'

charts/prompt/Chart.yaml

@@ -0,0 +1,56 @@
+apiVersion: v2
+name: prompt
+description: >-
+  PROMPT 2.0 - a modular course-management platform (micro-frontend + Go
+  microservices). Umbrella chart composing the platform core, per-phase
+  subcharts, and the shared infrastructure (CloudNativePG, SeaweedFS,
+  Gateway API, optional Keycloak).
+type: application
+version: 0.1.0
+appVersion: "latest"
+home: https://prompt.aet.cit.tum.de
+sources:
+  - https://github.com/prompt-edu/prompt
+maintainers:
+  - name: PROMPT maintainers
+    url: https://github.com/prompt-edu/prompt
+
+dependencies:
+  - name: prompt-common
+    version: 0.1.0
+    repository: file://charts/prompt-common
+  - name: infrastructure
+    version: 0.1.0
+    repository: file://charts/infrastructure
+  - name: core
+    version: 0.1.0
+    repository: file://charts/core
+    condition: core.enabled
+  - name: assessment
+    version: 0.1.0
+    repository: file://charts/assessment
+    condition: assessment.enabled
+  - name: interview
+    version: 0.1.0
+    repository: file://charts/interview
+    condition: interview.enabled
+  - name: team-allocation
+    version: 0.1.0
+    repository: file://charts/team-allocation
+    condition: team-allocation.enabled
+  - name: self-team-allocation
+    version: 0.1.0
+    repository: file://charts/self-team-allocation
+    condition: self-team-allocation.enabled
+  - name: certificate
+    version: 0.1.0
+    repository: file://charts/certificate
+    condition: certificate.enabled
+  - name: matching
+    version: 0.1.0
+    repository: file://charts/matching
+    condition: matching.enabled
+  - name: example
+    version: 0.1.0
+    repository: file://charts/example
+    condition: example.enabled

charts/prompt/charts/assessment/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: assessment
+description: PROMPT assessment phase - server + micro-frontend.
+type: application
+version: 0.1.0

charts/prompt/charts/assessment/templates/components.yaml

@@ -0,0 +1,3 @@
+{{ include "prompt.server" (dict "root" . "name" "assessment" "comp" .Values.server) }}
+---
+{{ include "prompt.client" (dict "root" . "name" "assessment" "comp" .Values.client) }}

charts/prompt/charts/assessment/values.yaml

@@ -0,0 +1,17 @@
+# Overridden by the umbrella `assessment:` block; defaults for standalone use.
+enabled: true
+server:
+  enabled: true
+  image: prompt-server-assessment
+  replicas: 1
+  port: 8080
+  apiPath: /assessment/api
+  dbKey: assessment
+  rateLimited: true
+client:
+  enabled: true
+  image: prompt-clients-assessment-component
+  replicas: 1
+  port: 80
+  path: /assessment
+  stripPrefix: true

charts/prompt/charts/certificate/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: certificate
+description: PROMPT certificate phase - server + micro-frontend.
+type: application
+version: 0.1.0

charts/prompt/charts/certificate/templates/components.yaml

@@ -0,0 +1,3 @@
+{{ include "prompt.server" (dict "root" . "name" "certificate" "comp" .Values.server) }}
+---
+{{ include "prompt.client" (dict "root" . "name" "certificate" "comp" .Values.client) }}

charts/prompt/charts/certificate/values.yaml

@@ -0,0 +1,17 @@
+# Overridden by the umbrella `certificate:` block; defaults for standalone use.
+enabled: true
+server:
+  enabled: true
+  image: prompt-server-certificate
+  replicas: 1
+  port: 8080
+  apiPath: /certificate/api
+  dbKey: certificate
+  rateLimited: true
+client:
+  enabled: true
+  image: prompt-clients-certificate-component
+  replicas: 1
+  port: 80
+  path: /certificate
+  stripPrefix: true

charts/prompt/charts/core/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: core
+description: PROMPT platform core - server-core (API) + client-core (app shell).
+type: application
+version: 0.1.0

charts/prompt/charts/core/templates/components.yaml

@@ -0,0 +1,3 @@
+{{ include "prompt.server" (dict "root" . "name" "core" "comp" .Values.server) }}
+---
+{{ include "prompt.client" (dict "root" . "name" "core" "comp" .Values.client) }}

charts/prompt/charts/core/values.yaml

@@ -0,0 +1,17 @@
+# Overridden by the umbrella `core:` block; defaults for standalone use.
+enabled: true
+server:
+  enabled: true
+  image: prompt-server-core
+  replicas: 2
+  port: 8080
+  apiPath: /api
+  dbKey: core
+  rateLimited: true
+client:
+  enabled: true
+  image: prompt-clients-core
+  replicas: 1
+  port: 80
+  path: /
+  stripPrefix: false

charts/prompt/charts/example/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: example
+description: PROMPT example micro-frontend (client only).
+type: application
+version: 0.1.0

charts/prompt/charts/example/templates/components.yaml

@@ -0,0 +1 @@
+{{ include "prompt.client" (dict "root" . "name" "example" "comp" .Values.client) }}

charts/prompt/charts/example/values.yaml

@@ -0,0 +1,9 @@
+# Overridden by the umbrella `example:` block; defaults for standalone use.
+enabled: true
+client:
+  enabled: true
+  image: prompt-clients-example-component
+  replicas: 1
+  port: 80
+  path: /example
+  stripPrefix: true

charts/prompt/charts/infrastructure/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v2
+name: infrastructure
+description: >-
+  Cross-cutting infrastructure for PROMPT: CloudNativePG cluster + databases,
+  SeaweedFS object storage, Gateway API + cert-manager TLS, and optional
+  in-cluster Keycloak. Shared ConfigMap/Secret consumed by every component.
+type: application
+version: 0.1.0

charts/prompt/charts/infrastructure/templates/app.yaml

@@ -0,0 +1,35 @@
+{{/*
+Shared application config and secret, consumed by every component via envFrom.
+The ConfigMap body lives in prompt-common (prompt.appConfigData) so workloads can
+hash it; the Secret is assembled from a resolved copy of appSecrets.data.
+*/}}
+{{- $data := dict -}}
+{{- if not .Values.global.appSecrets.existingSecret -}}
+{{- $data = deepCopy .Values.global.appSecrets.data -}}
+{{- $_ := set $data "S3_SECRET_KEY" (required "global.appSecrets.data.S3_SECRET_KEY is required (or set global.appSecrets.existingSecret)" $data.S3_SECRET_KEY) -}}
+{{- if eq .Values.global.objectStorage.mode "external" -}}
+{{- $_ := set $data "S3_ACCESS_KEY" (required "global.appSecrets.data.S3_ACCESS_KEY is required when global.objectStorage.mode=external" $data.S3_ACCESS_KEY) -}}
+{{- end -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "prompt.appConfigName" . }}
+  labels:
+    {{- include "prompt.labels" (dict "root" . "component" "app-config") | nindent 4 }}
+data:
+  {{- include "prompt.appConfigData" . | nindent 2 }}
+{{ if not .Values.global.appSecrets.existingSecret }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "prompt.appSecretName" . }}
+  labels:
+    {{- include "prompt.labels" (dict "root" . "component" "app-secrets") | nindent 4 }}
+type: Opaque
+stringData:
+  {{- range $k, $v := $data }}
+  {{ $k }}: {{ $v | quote }}
+  {{- end }}
+{{- end }}

charts/prompt/charts/infrastructure/templates/gateway.yaml

@@ -0,0 +1,80 @@
+{{- $g := .Values.global.gateway -}}
+{{- $host := .Values.global.host -}}
+{{- $cm := $g.certManager -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: {{ $g.name }}
+  labels:
+    {{- include "prompt.labels" (dict "root" . "component" "gateway") | nindent 4 }}
+  {{- if $cm.enabled }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ $cm.issuerName }}
+  {{- end }}
+spec:
+  gatewayClassName: {{ $g.gatewayClassName }}
+  listeners:
+    # HTTP listener: serves ACME HTTP-01 challenges and (optionally) redirects.
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: apex
+      protocol: HTTPS
+      port: 443
+      hostname: {{ $host | quote }}
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: {{ printf "%s-tls-apex" .Release.Name }}
+    {{- if eq .Values.global.objectStorage.mode "in-cluster" }}
+    - name: s3
+      protocol: HTTPS
+      port: 443
+      hostname: {{ printf "s3.%s" $host | quote }}
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: {{ printf "%s-tls-s3" .Release.Name }}
+    {{- end }}
+    {{- if eq .Values.global.keycloak.mode "in-cluster" }}
+    - name: auth
+      protocol: HTTPS
+      port: 443
+      hostname: {{ printf "auth.%s" $host | quote }}
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: {{ printf "%s-tls-auth" .Release.Name }}
+    {{- end }}
+{{- if and $cm.enabled $cm.create }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ $cm.issuerName }}
+spec:
+  acme:
+    email: {{ $cm.email | quote }}
+    server: {{ $cm.server | quote }}
+    privateKeySecretRef:
+      name: {{ $cm.issuerName }}-account-key
+    solvers:
+      - http01:
+          gatewayHTTPRoute:
+            parentRefs:
+              - name: {{ $g.name }}
+                namespace: {{ .Release.Namespace }}
+                sectionName: http
+{{- end }}