Wave-2 right-sizing and inter-hub removal (RAPPS-WP-0018, CSOC-WP-0017, REUSE-WP-0026)
- coulomb-social: requests 100m/256Mi -> 15m/176Mi (limits unchanged)
- reuse-surface: main 100m/256Mi -> 5m/64Mi, landing 10m/32Mi -> 5m/16Mi
- vergabe-demo-company: memory request 256Mi -> 512Mi, CPU 60m kept
- inter-hub (retired, CORE-WP-0007): delete chart, values, Make targets,
smoke script and production deploy workflow; release to be uninstalled
Full renders vs live: resources only, except the vergabe release-unit label
from 64530e1 not yet on its Service and PVCs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
This commit is contained in:
parent
1dd7387cbc
commit
b7fb7b226f
18 changed files with 41 additions and 426 deletions
|
|
@ -1,7 +1,7 @@
|
|||
## Stack
|
||||
|
||||
- **Language:** Helm values + Kubernetes manifests, Bash Make targets
|
||||
- **Key deps:** vergabe-teilnahme (Django) and inter-hub releases, shared apps-pg cnpg cluster, SOPS/age; runs against the S2 cluster on railiance01
|
||||
- **Key deps:** vergabe-teilnahme (Django), coulomb-social and reuse-surface releases (inter-hub retired and removed), shared apps-pg cnpg cluster, SOPS/age; runs against the S2 cluster on railiance01
|
||||
|
||||
## Dev Commands
|
||||
|
||||
|
|
@ -13,7 +13,7 @@ make vergabe-dry-run # helm template render, no apply
|
|||
make vergabe-status # pod / svc / ingress / cert state (read-only)
|
||||
make vergabe-deploy # production-touching
|
||||
make vergabe-migrate | vergabe-seed # production-touching (Django management)
|
||||
make check-inter-hub-image-tag # gate: explicit image tag for prod deploys
|
||||
make check-vergabe-image-tag # gate: explicit image tag for prod deploys
|
||||
```
|
||||
|
||||
`*-deploy` / `*-migrate` / `*-seed` change production workloads — operator
|
||||
|
|
|
|||
|
|
@ -1,50 +0,0 @@
|
|||
name: Inter-Hub production deploy
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: "Immutable inter-hub image tag to deploy, for example 5101eb5"
|
||||
required: true
|
||||
confirm:
|
||||
description: "Type deploy-inter-hub-production to confirm Railiance01 production deploy"
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: [self-hosted, haskelseed, linux_amd64]
|
||||
timeout-minutes: 20
|
||||
env:
|
||||
INTER_HUB_IMAGE_TAG: ${{ inputs.image_tag }}
|
||||
steps:
|
||||
- name: Check out repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Validate dispatch inputs
|
||||
env:
|
||||
CONFIRM: ${{ inputs.confirm }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ "$CONFIRM" != "deploy-inter-hub-production" ]; then
|
||||
echo "Refusing deploy: confirmation text did not match." >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! [[ "$INTER_HUB_IMAGE_TAG" =~ ^[A-Za-z0-9._-]+$ ]]; then
|
||||
echo "Refusing deploy: image_tag contains unsupported characters." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Verify image manifest exists
|
||||
run: make check-inter-hub-image
|
||||
|
||||
- name: Helm server dry-run
|
||||
run: make inter-hub-server-dry-run
|
||||
|
||||
- name: Deploy Inter-Hub
|
||||
run: make inter-hub-deploy
|
||||
|
||||
- name: Show release status
|
||||
run: make inter-hub-status
|
||||
|
||||
- name: Run public smoke checks
|
||||
run: make inter-hub-smoke
|
||||
60
Makefile
60
Makefile
|
|
@ -24,14 +24,6 @@ COULOMB_SOCIAL_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/coulomb-social
|
|||
COULOMB_SOCIAL_INGRESS ?= manifests/coulomb-social-ingress.yaml
|
||||
COULOMB_SOCIAL_ENV_SECRET ?= coulomb-social-env
|
||||
|
||||
INTER_HUB_RELEASE ?= inter-hub
|
||||
INTER_HUB_NAMESPACE ?= inter-hub
|
||||
INTER_HUB_CHART ?= charts/inter-hub
|
||||
INTER_HUB_VALUES ?= helm/inter-hub-values.yaml
|
||||
INTER_HUB_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/inter-hub
|
||||
INTER_HUB_IMAGE_TAG ?=
|
||||
INTER_HUB_BASE_URL ?= https://hub.coulomb.social
|
||||
|
||||
REUSE_RELEASE ?= reuse
|
||||
REUSE_NAMESPACE ?= reuse
|
||||
REUSE_CHART ?= charts/reuse-surface
|
||||
|
|
@ -52,7 +44,6 @@ POLICY_NEXUS_REVISION ?=
|
|||
COULOMBCORE_KUBECONFIG ?= $(HOME)/.kube/config
|
||||
RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-railiance01
|
||||
PRODUCTION_KUBECONFIG ?= $(COULOMBCORE_KUBECONFIG)
|
||||
INTER_HUB_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
|
||||
REUSE_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
|
||||
FORGEJO_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG)
|
||||
FORGEJO_RELEASE ?= forgejo
|
||||
|
|
@ -75,8 +66,6 @@ FORGEJO_MAILER_EXTERNAL_SECRET ?= manifests/forgejo-mailer-externalsecret.yaml
|
|||
REUSE_RUNTIME_EXTERNAL_SECRET ?= manifests/reuse-surface-runtime-externalsecret.yaml
|
||||
PLATFORM_REPO ?= $(HOME)/railiance-platform
|
||||
ESO_CHART_VERSION ?= 0.16.1
|
||||
INTER_HUB_IMAGE_REF = $(INTER_HUB_IMAGE_REPOSITORY):$(INTER_HUB_IMAGE_TAG)
|
||||
INTER_HUB_IMAGE_SET_ARG = $(if $(strip $(INTER_HUB_IMAGE_TAG)),--set image.tag=$(INTER_HUB_IMAGE_TAG),)
|
||||
|
||||
CORE_HUB_RELEASE ?= core-hub
|
||||
CORE_HUB_NAMESPACE ?= core-hub
|
||||
|
|
@ -139,16 +128,6 @@ check-coulombcore-kubeconfig: ## Verify CoulombCore kubeconfig and k3s API tunne
|
|||
|
||||
check-production-kubeconfig: check-coulombcore-kubeconfig ## Verify production app cluster API (CoulombCore)
|
||||
|
||||
check-inter-hub-image-tag: ## Require an explicit inter-hub image tag for production deploys
|
||||
@test -n "$(INTER_HUB_IMAGE_TAG)" || { \
|
||||
echo "Set INTER_HUB_IMAGE_TAG=<sha> for inter-hub production deploys." >&2; \
|
||||
echo "Example: INTER_HUB_IMAGE_TAG=91037a4 make inter-hub-deploy" >&2; \
|
||||
exit 1; \
|
||||
}
|
||||
|
||||
check-inter-hub-image: check-inter-hub-image-tag ## Verify the inter-hub OCI image tag exists before deploy
|
||||
tools/check-oci-image.sh "$(INTER_HUB_IMAGE_REF)"
|
||||
|
||||
check-core-hub-image-tag: ## Require an explicit core-hub image tag for production deploys
|
||||
@test -n "$(CORE_HUB_IMAGE_TAG)" || { \
|
||||
echo "Set CORE_HUB_IMAGE_TAG=<sha> for core-hub production deploys." >&2; \
|
||||
|
|
@ -315,43 +294,6 @@ coulomb-social-env-secret: ## Create/patch coulomb-social-env (SECRET_KEY, DATAB
|
|||
|
||||
coulomb-social-env-secret-dry-run: ## Plan coulomb-social-env keys without applying
|
||||
@bash tools/create-coulomb-social-env-secret.sh --dry-run $(COULOMB_SOCIAL_ENV_SECRET_ARGS)
|
||||
##@ Inter-Hub
|
||||
|
||||
inter-hub-render-baseline: ## Render checked-in inter-hub values for chart validation only
|
||||
helm template $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
|
||||
--namespace $(INTER_HUB_NAMESPACE) \
|
||||
-f $(INTER_HUB_VALUES)
|
||||
|
||||
inter-hub-dry-run: check-railiance01-kubeconfig check-inter-hub-image-tag ## helm template render with an explicit production image tag
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm template $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
|
||||
--namespace $(INTER_HUB_NAMESPACE) \
|
||||
-f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG)
|
||||
|
||||
inter-hub-server-dry-run: check-railiance01-kubeconfig check-inter-hub-image ## Helm server dry-run inter-hub upgrade on Railiance01
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm upgrade --install $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
|
||||
--namespace $(INTER_HUB_NAMESPACE) --create-namespace \
|
||||
-f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) --dry-run=server --timeout 5m
|
||||
|
||||
inter-hub-deploy: check-railiance01-kubeconfig check-inter-hub-image ## Deploy / upgrade inter-hub Helm release on Railiance01
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm upgrade --install $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \
|
||||
--namespace $(INTER_HUB_NAMESPACE) --create-namespace \
|
||||
-f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) --wait --timeout 5m
|
||||
|
||||
inter-hub-status: check-railiance01-kubeconfig ## Show inter-hub pod / svc / ingress / cert state on Railiance01
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl get pods,svc,ingress,certificate -n $(INTER_HUB_NAMESPACE) -l app=$(INTER_HUB_RELEASE) --ignore-not-found
|
||||
|
||||
inter-hub-release-info: check-railiance01-kubeconfig ## Show inter-hub Helm history, values, deployment, and pods
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm history $(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE)
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm get values $(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE)
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl describe deploy/$(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE)
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl get pods -n $(INTER_HUB_NAMESPACE) -o wide
|
||||
|
||||
inter-hub-smoke: ## Verify public inter-hub v2 route and OpenAPI surface after rollout
|
||||
INTER_HUB_BASE_URL="$(INTER_HUB_BASE_URL)" tools/inter-hub-smoke.sh
|
||||
|
||||
inter-hub-logs: check-railiance01-kubeconfig ## Tail inter-hub app logs from Railiance01
|
||||
KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl logs -n $(INTER_HUB_NAMESPACE) -l app=$(INTER_HUB_RELEASE) -f --tail=50
|
||||
|
||||
##@ Core Hub
|
||||
|
||||
core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership
|
||||
|
|
@ -652,7 +594,7 @@ help: ## Show this help
|
|||
/^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
|
||||
/^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
|
||||
|
||||
.PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help
|
||||
.PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help
|
||||
|
||||
.PHONY: forgejo-secret-scan-template-deploy
|
||||
|
||||
|
|
|
|||
|
|
@ -1,16 +0,0 @@
|
|||
apiVersion: v2
|
||||
name: inter-hub
|
||||
description: |
|
||||
Interaction Hub Framework reference deployment for Railiance01.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.2.0-alpha.1"
|
||||
keywords:
|
||||
- ihf
|
||||
- inter-hub
|
||||
- railiance
|
||||
home: https://forgejo.coulomb.social/coulomb/inter-hub-haskell
|
||||
sources:
|
||||
- https://forgejo.coulomb.social/coulomb/inter-hub-haskell
|
||||
maintainers:
|
||||
- name: railiance-apps
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
{{/*
|
||||
Chart name + release name produce a unique resource name.
|
||||
*/}}
|
||||
{{- define "interhub.fullname" -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "interhub.labels" -}}
|
||||
app: {{ include "interhub.fullname" . }}
|
||||
app.kubernetes.io/name: {{ include "interhub.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/part-of: railiance-apps
|
||||
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "interhub.selectorLabels" -}}
|
||||
app: {{ include "interhub.fullname" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "interhub.image" -}}
|
||||
{{- if not .Values.image.tag -}}
|
||||
{{- fail "image.tag is required - pin it in helm/inter-hub-values.yaml or pass --set image.tag=<sha>" -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
|
||||
{{- end -}}
|
||||
|
|
@ -1,59 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "interhub.fullname" . }}
|
||||
labels: {{- include "interhub.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels: {{- include "interhub.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "interhub.labels" . | nindent 8 }}
|
||||
spec:
|
||||
securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: inter-hub
|
||||
image: {{ include "interhub.image" . | quote }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ .Values.envSecretName | quote }}
|
||||
{{- if .Values.probes.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.path }}
|
||||
port: {{ .Values.probes.port }}
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.path }}
|
||||
port: {{ .Values.probes.port }}
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
{{- end }}
|
||||
resources: {{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "interhub.fullname" . }}
|
||||
labels: {{- include "interhub.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- toYaml .Values.ingress.annotations | nindent 4 }}
|
||||
spec:
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ .Values.ingress.host }}
|
||||
secretName: {{ include "interhub.fullname" . }}-tls
|
||||
{{- end }}
|
||||
rules:
|
||||
- host: {{ .Values.ingress.host }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "interhub.fullname" . }}
|
||||
port:
|
||||
number: {{ .Values.service.port }}
|
||||
{{- end }}
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "interhub.fullname" . }}
|
||||
labels: {{- include "interhub.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector: {{- include "interhub.selectorLabels" . | nindent 4 }}
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
image:
|
||||
repository: forgejo.coulomb.social/coulomb/inter-hub
|
||||
tag: "" # required; pinned via helm/inter-hub-values.yaml or --set image.tag=<sha>
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8000
|
||||
targetPort: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 2Gi
|
||||
|
||||
# Env from the K8s Secret created from inter-hub's SOPS handoff file:
|
||||
# deploy/railiance/secrets/inter-hub.env.sops.yaml
|
||||
envSecretName: inter-hub-env
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
host: hub.coulomb.social
|
||||
tls: true
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
|
||||
probes:
|
||||
enabled: true
|
||||
path: /
|
||||
port: 8000
|
||||
liveness:
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
|
@ -7,6 +7,14 @@ deployments on CoulombCore and railiance01 are scaled to `0`.
|
|||
This document preserves the Railiance01 Helm surface for audit only. Do not
|
||||
deploy Inter-Hub to production.
|
||||
|
||||
**Removed 2026-10-21 (`RAPPS-WP-0018`, founder-approved wave 2).** The
|
||||
`charts/inter-hub` chart, `helm/inter-hub-values.yaml`, the `inter-hub-*` Make
|
||||
targets, `tools/inter-hub-smoke.sh` and the
|
||||
`.gitea/workflows/inter-hub-production-deploy.yaml` workflow are deleted. The
|
||||
release (0 replicas, latent 250m/512Mi request) is uninstalled with
|
||||
`helm uninstall inter-hub -n inter-hub`. The commands below no longer exist;
|
||||
recover them from git history if ever needed.
|
||||
|
||||
## Hosts and release surface
|
||||
|
||||
| Server | IP | Role |
|
||||
|
|
|
|||
|
|
@ -71,7 +71,6 @@ The app-specific targets also accept explicit overrides:
|
|||
|
||||
```bash
|
||||
REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status
|
||||
INTER_HUB_KUBECONFIG=~/.kube/config-railiance01 make inter-hub-status
|
||||
```
|
||||
|
||||
## SOPS Age Key Bootstrap
|
||||
|
|
|
|||
|
|
@ -38,3 +38,13 @@ persistence:
|
|||
size: 2Gi
|
||||
mountPath: /app/var/content
|
||||
retain: true
|
||||
|
||||
# Wave-2 right-sizing (CSOC-WP-0017-T01, 2026-10-21 node budget): 7d p95
|
||||
# 0.4m CPU / 146Mi. Limits stay at the chart defaults (1000m/1Gi).
|
||||
resources:
|
||||
requests:
|
||||
cpu: 15m
|
||||
memory: 176Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
|
|
|||
|
|
@ -1,6 +0,0 @@
|
|||
# Production overrides for the inter-hub Helm chart.
|
||||
# Non-secret values only; DATABASE_URL and IHP_SESSION_SECRET come from the
|
||||
# Secret 'inter-hub-env' in the inter-hub namespace.
|
||||
|
||||
image:
|
||||
tag: "fde5525" # Render baseline only; production deploy requires INTER_HUB_IMAGE_TAG=<sha>.
|
||||
|
|
@ -15,8 +15,26 @@ image:
|
|||
repository: forgejo.coulomb.social/coulomb/reuse-surface
|
||||
digest: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0
|
||||
|
||||
# Wave-2 right-sizing (REUSE-WP-0026-T01, 2026-10-21 node budget): pod
|
||||
# aggregate 110m/288Mi -> 10m/80Mi; 7d p95 2.1m CPU; split by
|
||||
# per-pod p95 x1.15 (main ~51Mi -> 64Mi, landing ~5Mi -> 16Mi). Limits unchanged.
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
|
||||
landing:
|
||||
enabled: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 16Mi
|
||||
limits:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
title: "REUSE federation endpoint"
|
||||
eyebrow: "reuse.coulomb.social"
|
||||
body: "This is the Railiance REUSE capability federation service. It is an API endpoint for automated clients and operators; there is no browser login for this service."
|
||||
|
|
|
|||
|
|
@ -11,7 +11,8 @@ replicaCount: 1
|
|||
resources:
|
||||
requests:
|
||||
cpu: 60m
|
||||
memory: 256Mi
|
||||
# Wave-2 (RAPPS-WP-0018-T01): target replay loaded working set 320-480MiB.
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
|
|
|||
|
|
@ -78,7 +78,6 @@ evidence:
|
|||
- SCOPE.md
|
||||
tests:
|
||||
- tools/forgejo-smoke.sh
|
||||
- tools/inter-hub-smoke.sh
|
||||
- tools/k8s-server-dry-run.sh
|
||||
consumer_feedback: []
|
||||
bug_reports: []
|
||||
|
|
|
|||
|
|
@ -1,87 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
base_url="${INTER_HUB_BASE_URL:-https://hub.coulomb.social}"
|
||||
base_url="${base_url%/}"
|
||||
|
||||
tmpdir="$(mktemp -d)"
|
||||
trap 'rm -rf "$tmpdir"' EXIT
|
||||
|
||||
request() {
|
||||
local name="$1"
|
||||
local url="$2"
|
||||
local expected_status="$3"
|
||||
local body="$tmpdir/${name}.json"
|
||||
local status
|
||||
|
||||
status="$(curl -sS -o "$body" -w "%{http_code}" "$url")"
|
||||
if [[ "$status" != "$expected_status" ]]; then
|
||||
echo "ERROR: expected $url to return $expected_status, got $status" >&2
|
||||
cat "$body" >&2
|
||||
echo >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "$body"
|
||||
}
|
||||
|
||||
hubs_body="$(request hubs "${base_url}/api/v2/hubs" 200)"
|
||||
python3 - "$hubs_body" <<'PY'
|
||||
import json
|
||||
import sys
|
||||
|
||||
with open(sys.argv[1], encoding="utf-8") as fh:
|
||||
payload = json.load(fh)
|
||||
|
||||
if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
|
||||
raise SystemExit("/api/v2/hubs did not return a paginated data list")
|
||||
|
||||
print("ok: /api/v2/hubs returned public discovery JSON")
|
||||
PY
|
||||
|
||||
widgets_body="$(request widgets "${base_url}/api/v2/widgets" 401)"
|
||||
hub_registry_body="$(request hub-registry "${base_url}/api/v2/hub-registry" 401)"
|
||||
|
||||
python3 - "$widgets_body" "$hub_registry_body" <<'PY'
|
||||
import json
|
||||
import sys
|
||||
|
||||
for path, filename in (
|
||||
("/api/v2/widgets", sys.argv[1]),
|
||||
("/api/v2/hub-registry", sys.argv[2]),
|
||||
):
|
||||
with open(filename, encoding="utf-8") as fh:
|
||||
payload = json.load(fh)
|
||||
code = payload.get("code") if isinstance(payload, dict) else None
|
||||
if code != "invalid_api_key":
|
||||
raise SystemExit(f"{path} returned 401 but not invalid_api_key JSON")
|
||||
print(f"ok: {path} requires an API key")
|
||||
PY
|
||||
|
||||
openapi_body="$(request openapi "${base_url}/api/v2/openapi.json" 200)"
|
||||
python3 - "$openapi_body" <<'PY'
|
||||
import json
|
||||
import sys
|
||||
|
||||
required_paths = {
|
||||
"/hubs",
|
||||
"/hub-capability-manifests",
|
||||
"/api-consumers",
|
||||
"/policy-scopes",
|
||||
"/widgets",
|
||||
"/hub-registry",
|
||||
}
|
||||
|
||||
with open(sys.argv[1], encoding="utf-8") as fh:
|
||||
payload = json.load(fh)
|
||||
|
||||
paths = payload.get("paths")
|
||||
if not isinstance(paths, dict):
|
||||
raise SystemExit("/api/v2/openapi.json did not include an OpenAPI paths object")
|
||||
|
||||
missing = sorted(required_paths - set(paths))
|
||||
if missing:
|
||||
raise SystemExit("OpenAPI missing paths: " + ", ".join(missing))
|
||||
|
||||
print("ok: /api/v2/openapi.json lists expected v2 resources")
|
||||
PY
|
||||
|
|
@ -8,11 +8,6 @@ VERGABE_RELEASE="${VERGABE_RELEASE:-vergabe-teilnahme}"
|
|||
VERGABE_NAMESPACE="${VERGABE_NAMESPACE:-vergabe-teilnahme}"
|
||||
VERGABE_CHART="${VERGABE_CHART:-charts/vergabe-teilnahme}"
|
||||
VERGABE_VALUES="${VERGABE_VALUES:-helm/vergabe-teilnahme-values.yaml}"
|
||||
INTER_HUB_RELEASE="${INTER_HUB_RELEASE:-inter-hub}"
|
||||
INTER_HUB_NAMESPACE="${INTER_HUB_NAMESPACE:-inter-hub}"
|
||||
INTER_HUB_CHART="${INTER_HUB_CHART:-charts/inter-hub}"
|
||||
INTER_HUB_VALUES="${INTER_HUB_VALUES:-helm/inter-hub-values.yaml}"
|
||||
INTER_HUB_IMAGE_TAG="${INTER_HUB_IMAGE_TAG:-}"
|
||||
DRY_RUN_CREATE_NAMESPACES="${DRY_RUN_CREATE_NAMESPACES:-false}"
|
||||
|
||||
for cmd in kubectl helm; do
|
||||
|
|
@ -33,33 +28,18 @@ fi
|
|||
if [[ "$DRY_RUN_CREATE_NAMESPACES" == "true" ]]; then
|
||||
echo "server dry-run: ensuring namespace $VERGABE_NAMESPACE exists"
|
||||
kubectl create namespace "$VERGABE_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
|
||||
echo "server dry-run: ensuring namespace $INTER_HUB_NAMESPACE exists"
|
||||
kubectl create namespace "$INTER_HUB_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
|
||||
fi
|
||||
|
||||
tmpdir="$(mktemp -d)"
|
||||
trap 'rm -rf "$tmpdir"' EXIT
|
||||
inter_hub_image_args=()
|
||||
if [[ -n "$INTER_HUB_IMAGE_TAG" ]]; then
|
||||
inter_hub_image_args=(--set "image.tag=$INTER_HUB_IMAGE_TAG")
|
||||
fi
|
||||
|
||||
helm template "$VERGABE_RELEASE" "$VERGABE_CHART" \
|
||||
--namespace "$VERGABE_NAMESPACE" \
|
||||
-f "$VERGABE_VALUES" \
|
||||
> "$tmpdir/vergabe-teilnahme.yaml"
|
||||
|
||||
helm template "$INTER_HUB_RELEASE" "$INTER_HUB_CHART" \
|
||||
--namespace "$INTER_HUB_NAMESPACE" \
|
||||
-f "$INTER_HUB_VALUES" \
|
||||
"${inter_hub_image_args[@]}" \
|
||||
> "$tmpdir/inter-hub.yaml"
|
||||
|
||||
echo "server dry-run: committed manifests"
|
||||
kubectl apply --dry-run=server -f manifests
|
||||
|
||||
echo "server dry-run: rendered $VERGABE_RELEASE chart"
|
||||
kubectl apply --dry-run=server -n "$VERGABE_NAMESPACE" -f "$tmpdir/vergabe-teilnahme.yaml"
|
||||
|
||||
echo "server dry-run: rendered $INTER_HUB_RELEASE chart"
|
||||
kubectl apply --dry-run=server -n "$INTER_HUB_NAMESPACE" -f "$tmpdir/inter-hub.yaml"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue