coulomb/state-hub
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
state-hub/deploy/railiance
History
tegwick 5ae1f4ffc5
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Multi-Context Image / build-and-push (push) Successful in 27s
Details
fix(deploy): pin main-470ece8, and check pins against real builds 
The upgrade failed as `pre-upgrade hooks failed: timed out waiting for the
condition`. The migrate hook was in ImagePullBackOff: tag main-11f689d does not
exist. `.forgejo/workflows/image.yaml` has a `paths:` filter that excludes
deploy/**, so the chart-only commit was green in CI and built nothing — the two
green runs on it were host-smoke and container-smoke, not build-and-push.

470ece8 carries all the code; every commit after it touches only the chart and
generated docs.

scripts/verify_image_pin.py refuses a pin whose commit has no successful
build-and-push run, and says so in those terms rather than as a timeout five
minutes later. Verified against both the bad pin and the good one; treats an
unreachable forge as inconclusive rather than as failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-28 00:08:31 +02:00
..
apps fix(deploy): pin main-470ece8, and check pins against real builds 2026-08-28 00:08:31 +02:00
platform feat(statehub): deploy empty railiance state hub 2026-06-25 15:39:53 +02:00
README.md Migrate state-hub image and clone refs to Forgejo (RAIL-HO-WP-0006) 2026-07-09 11:59:08 +02:00

README.md

State Hub Railiance Deployment Handoff

This directory contains the State Hub deployment handoff for CUST-WP-0011. It is source-owned by state-hub and split along the Railiance ownership boundaries used for the actual cluster rollout.

Ownership

  • deploy/railiance/platform/ is the railiance-platform handoff for the state-hub-db CloudNativePG cluster, database bootstrap credential, and database NetworkPolicies in the databases namespace.
  • deploy/railiance/apps/ is the railiance-apps handoff for the State Hub API Helm chart, non-secret production values, and app namespace runtime Secret template.
  • Runtime secret values are not stored here. Replace placeholder passwords only in an operator-controlled file, then encrypt or deliver through the approved platform secret path.

Image

The current image is pinned to:

forgejo.coulomb.social/coulomb/state-hub:f2e042a

railiance01 has already pulled this tag with crictl, and the image serves GET /state/health against the local WSL database in smoke testing.

Render And Dry-Run

Render the app chart without touching the cluster:

make railiance-state-hub-render

Run client-side Kubernetes validation for the platform manifests, app Secret template, and rendered chart:

make railiance-state-hub-client-dry-run

Run server-side dry-run against the configured representative cluster:

KUBECONFIG=~/.kube/config-hosteurope make railiance-state-hub-server-dry-run

Server-side dry-run requires the CNPG CRDs, namespace permissions, and dry-run permission for resources in databases and state-hub. Before the state-hub namespace exists, Kubernetes cannot server-dry-run namespaced app objects into that namespace because dry-run Namespace creation is not persisted. The Make target therefore server-validates the platform and Namespace manifests, then falls back to client dry-run for namespaced app manifests with an explicit notice.

Promotion Notes

Platform promotion into railiance-platform:

  • copy platform/state-hub-db-credentials.sops.yaml.template to a real SOPS secret file with an operator-generated password;
  • apply or GitOps-manage platform/state-hub-db-cluster.yaml;
  • apply or GitOps-manage platform/state-hub-db-networkpolicies.yaml.

App promotion into railiance-apps:

  • copy apps/charts/state-hub/ to charts/state-hub/;
  • copy apps/helm/state-hub-values.yaml to helm/state-hub-values.yaml;
  • apply or GitOps-manage apps/manifests/state-hub-namespace.yaml;
  • create state-hub-env in the state-hub namespace from the approved secret-delivery path;
  • deploy with Helm using the production values file, which sets namespace.create=false, only after state-hub-db is healthy.

Runtime Secret Contract

The app chart expects a Kubernetes Secret named state-hub-env in the state-hub namespace with at least:

DATABASE_URL=postgresql+asyncpg://state_hub:<url-encoded-password>@state-hub-db-rw.databases.svc.cluster.local:5432/state_hub

Optional runtime settings such as CORS_ORIGINS can live in the chart ConfigMap. The default chart keeps public ingress disabled; access should use the existing private tunnel/ops-bridge path until a separate exposure decision is recorded.