Skip to content

Commit dc04413

Browse files
ConProgrammingConProgramming
authored
Merge pull request #13 from GovSignals/plt-663-chart-fixes
fix(chart): PLT-663 self-hosted install bugs
2 parents c5ae427 + f66ed13 commit dc04413

8 files changed

Lines changed: 103 additions & 10 deletions

File tree

‎apps/supervisor/src/workloadManager/kubernetes.ts‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,11 @@ export class KubernetesWorkloadManager implements WorkloadManager {
118118
"app.kubernetes.io/component": "create",
119119
},
120120
...(Object.keys(env.KUBERNETES_WORKER_POD_ANNOTATIONS).length > 0
121-
? { annotations: { ...env.KUBERNETES_WORKER_POD_ANNOTATIONS } }
121+
? {
122+
annotations: {
123+
...env.KUBERNETES_WORKER_POD_ANNOTATIONS,
124+
} as Record<string, string>,
125+
}
122126
: {}),
123127
},
124128
spec: {

‎docker/scripts/entrypoint.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
#!/bin/sh
22
set -xe
33

4+
if [ "$1" = "migrate" ]; then
5+
echo "Running migrations only (entrypoint.sh migrate mode)"
6+
SKIP_POSTGRES_MIGRATIONS=0
7+
fi
8+
49
if [ -n "$DATABASE_HOST" ]; then
510
scripts/wait-for-it.sh ${DATABASE_HOST} -- echo "database is up"
611
fi
@@ -39,6 +44,11 @@ else
3944
echo "CLICKHOUSE_URL not set, skipping ClickHouse migrations."
4045
fi
4146

47+
if [ "$1" = "migrate" ]; then
48+
echo "Migrations complete, exiting."
49+
exit 0
50+
fi
51+
4252
# Copy over required prisma files
4353
cp internal-packages/database/prisma/schema.prisma apps/webapp/prisma/
4454
cp node_modules/@prisma/engines/*.node apps/webapp/prisma/

‎hosting/k8s/helm/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: trigger
33
description: The official Trigger.dev Helm chart
44
type: application
5-
version: 4.4.6
5+
version: 4.4.6-plt663.1
66
appVersion: v4.4.6
77
home: https://trigger.dev
88
sources:

‎hosting/k8s/helm/templates/_helpers.tpl‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -401,11 +401,14 @@ ClickHouse hostname
401401
{{/*
402402
ClickHouse URL for application (with secure parameter)
403403
404-
Note on the external+existingSecret branch: the password is expanded via
404+
Note on `$(CLICKHOUSE_PASSWORD)`: the password is expanded via
405405
Kubernetes' `$(VAR)` syntax, not shell `${VAR}`. Kubelet substitutes
406406
`$(CLICKHOUSE_PASSWORD)` at container-creation time from the
407407
CLICKHOUSE_PASSWORD env var declared just before CLICKHOUSE_URL in
408-
webapp.yaml. Shell-style `${...}` does not work here because
408+
webapp.yaml. Both the `deploy: true` and external+existingSecret
409+
branches use this placeholder so that the chart never bakes the
410+
password literal into a rendered URL string. Shell-style `${...}`
411+
does not work here because
409412
`docker/scripts/entrypoint.sh` assigns CLICKHOUSE_URL to GOOSE_DBSTRING
410413
with a single-pass expansion (`export GOOSE_DBSTRING="$CLICKHOUSE_URL"`),
411414
so any inner `${...}` reaches goose verbatim and fails URL parsing.
@@ -418,7 +421,7 @@ hex-encoded password or percent-encode before storing in the Secret.
418421
{{- if .Values.clickhouse.deploy -}}
419422
{{- $protocol := ternary "https" "http" .Values.clickhouse.secure -}}
420423
{{- $secure := ternary "true" "false" .Values.clickhouse.secure -}}
421-
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}@{{ include "trigger-v4.clickhouse.hostname" . }}:8123?secure={{ $secure }}
424+
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:$(CLICKHOUSE_PASSWORD)@{{ include "trigger-v4.clickhouse.hostname" . }}:8123?secure={{ $secure }}
422425
{{- else if .Values.clickhouse.external.host -}}
423426
{{- $protocol := ternary "https" "http" .Values.clickhouse.external.secure -}}
424427
{{- $secure := ternary "true" "false" .Values.clickhouse.external.secure -}}
@@ -439,7 +442,7 @@ applies to the replication URL.
439442
{{- define "trigger-v4.clickhouse.replication.url" -}}
440443
{{- if .Values.clickhouse.deploy -}}
441444
{{- $protocol := ternary "https" "http" .Values.clickhouse.secure -}}
442-
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}@{{ include "trigger-v4.clickhouse.hostname" . }}:8123
445+
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:$(CLICKHOUSE_PASSWORD)@{{ include "trigger-v4.clickhouse.hostname" . }}:8123
443446
{{- else if .Values.clickhouse.external.host -}}
444447
{{- $protocol := ternary "https" "http" .Values.clickhouse.external.secure -}}
445448
{{- if .Values.clickhouse.external.existingSecret -}}

‎hosting/k8s/helm/templates/electric.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,18 @@ spec:
8989
{{- end }}
9090
resources:
9191
{{- toYaml .Values.electric.resources | nindent 12 }}
92+
volumeMounts:
93+
- name: electric-persistent
94+
mountPath: /app/persistent
95+
{{- with .Values.electric.extraVolumeMounts }}
96+
{{- toYaml . | nindent 12 }}
97+
{{- end }}
98+
volumes:
99+
- name: electric-persistent
100+
emptyDir: {}
101+
{{- with .Values.electric.extraVolumes }}
102+
{{- toYaml . | nindent 8 }}
103+
{{- end }}
92104
---
93105
apiVersion: v1
94106
kind: Service

‎hosting/k8s/helm/templates/supervisor.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,18 @@ spec:
174174
value: {{ .Values.supervisor.config.kubernetes.workerServiceAccount | quote }}
175175
- name: KUBERNETES_WORKER_AUTOMOUNT_SERVICE_ACCOUNT_TOKEN
176176
value: {{ .Values.supervisor.config.kubernetes.workerAutomountServiceAccountToken | quote }}
177+
{{- if .Values.supervisor.config.kubernetes.workerPodSecurityContext }}
178+
- name: KUBERNETES_WORKER_POD_SECURITY_CONTEXT
179+
value: {{ .Values.supervisor.config.kubernetes.workerPodSecurityContext | toJson | quote }}
180+
{{- end }}
181+
{{- if .Values.supervisor.config.kubernetes.workerContainerSecurityContext }}
182+
- name: KUBERNETES_WORKER_CONTAINER_SECURITY_CONTEXT
183+
value: {{ .Values.supervisor.config.kubernetes.workerContainerSecurityContext | toJson | quote }}
184+
{{- end }}
185+
{{- if .Values.supervisor.config.kubernetes.workerPodAnnotations }}
186+
- name: KUBERNETES_WORKER_POD_ANNOTATIONS
187+
value: {{ .Values.supervisor.config.kubernetes.workerPodAnnotations | toJson | quote }}
188+
{{- end }}
177189
{{- $registryAuthEnabled := false }}
178190
{{- if .Values.registry.deploy }}
179191
{{- $registryAuthEnabled = .Values.registry.auth.enabled }}

‎hosting/k8s/helm/templates/webapp.yaml‎

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,24 @@ spec:
303303
secretKeyRef:
304304
name: {{ include "trigger-v4.secretsName" . }}
305305
key: MANAGED_WORKER_SECRET
306+
{{- end }}
307+
{{- /*
308+
Object-store credentials are scoped independently of the four
309+
session secrets above. Three branches:
310+
1. s3.deploy → mount from the chart's internal MinIO
311+
creds (s3.auth.existingSecret or the
312+
chart-managed s3-auth-* keys).
313+
2. s3.external.useIam → skip entirely. IRSA / Workload
314+
Identity provides credentials to the
315+
SDK; mounting OBJECT_STORE_* would
316+
force static-key mode.
317+
3. external static keys → s3.external.existingSecret, OR
318+
s3.external.accessKeyId when the
319+
chart is provisioning its own
320+
secret (requires secrets.enabled
321+
so secrets.yaml actually writes
322+
s3-access-key-id).
323+
*/}}
306324
{{- if .Values.s3.deploy }}
307325
{{- if .Values.s3.auth.existingSecret }}
308326
- name: OBJECT_STORE_ACCESS_KEY_ID
@@ -327,7 +345,7 @@ spec:
327345
name: {{ include "trigger-v4.secretsName" . }}
328346
key: s3-auth-secret-access-key
329347
{{- end }}
330-
{{- else }}
348+
{{- else if not .Values.s3.external.useIam }}
331349
{{- if .Values.s3.external.existingSecret }}
332350
- name: OBJECT_STORE_ACCESS_KEY_ID
333351
valueFrom:
@@ -339,7 +357,7 @@ spec:
339357
secretKeyRef:
340358
name: {{ include "trigger-v4.s3.external.secretName" . }}
341359
key: {{ include "trigger-v4.s3.external.secretAccessKeyKey" . }}
342-
{{- else if .Values.s3.external.accessKeyId }}
360+
{{- else if and .Values.secrets.enabled .Values.s3.external.accessKeyId }}
343361
- name: OBJECT_STORE_ACCESS_KEY_ID
344362
valueFrom:
345363
secretKeyRef:
@@ -352,7 +370,6 @@ spec:
352370
key: s3-secret-access-key
353371
{{- end }}
354372
{{- end }}
355-
{{- end }}
356373
{{- if .Values.webapp.observability }}
357374
{{- if .Values.webapp.observability.tracing.exporterUrl }}
358375
- name: INTERNAL_OTEL_TRACE_EXPORTER_URL
@@ -387,7 +404,17 @@ spec:
387404
- name: INTERNAL_OTEL_METRIC_EXPORTER_INTERVAL_MS
388405
value: {{ .Values.webapp.observability.metrics.exporterIntervalMs | quote }}
389406
{{- end }}
390-
{{- if and .Values.clickhouse.external.host .Values.clickhouse.external.existingSecret }}
407+
{{- if .Values.clickhouse.deploy }}
408+
- name: CLICKHOUSE_PASSWORD
409+
{{- if .Values.clickhouse.auth.existingSecret }}
410+
valueFrom:
411+
secretKeyRef:
412+
name: {{ .Values.clickhouse.auth.existingSecret }}
413+
key: {{ .Values.clickhouse.auth.existingSecretKey | default "admin-password" }}
414+
{{- else }}
415+
value: {{ .Values.clickhouse.auth.password | quote }}
416+
{{- end }}
417+
{{- else if and .Values.clickhouse.external.host .Values.clickhouse.external.existingSecret }}
391418
- name: CLICKHOUSE_PASSWORD
392419
valueFrom:
393420
secretKeyRef:

‎hosting/k8s/helm/values.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -640,6 +640,23 @@ electric:
640640
# - name: CUSTOM_VAR
641641
# value: "custom-value"
642642

643+
# Extra volumes added to the Electric pod. The Electric container always
644+
# has an emptyDir at /app/persistent regardless of this list — that's
645+
# required by the Electric runtime. Use `extraVolumes` for things like
646+
# an enterprise CA bundle ConfigMap.
647+
extraVolumes:
648+
[]
649+
# - name: ca-bundle
650+
# configMap:
651+
# name: enterprise-ca-bundle
652+
653+
# Extra volume mounts added to the Electric container.
654+
extraVolumeMounts:
655+
[]
656+
# - name: ca-bundle
657+
# mountPath: /etc/ssl/enterprise-ca
658+
# readOnly: true
659+
643660
# ClickHouse configuration
644661
# Subchart: https://github.com/bitnami/charts/tree/main/bitnami/clickhouse
645662
clickhouse:
@@ -756,6 +773,14 @@ s3:
756773
accessKeyId: "admin" # Default for internal MinIO - change for production
757774
secretAccessKey: "very-safe-password" # Default for internal MinIO - change for production
758775
#
776+
# IAM-based authentication (for AWS S3 with IRSA / GCP Workload Identity).
777+
# When true, the webapp pod skips the OBJECT_STORE_ACCESS_KEY_ID /
778+
# OBJECT_STORE_SECRET_ACCESS_KEY env vars entirely so the AWS SDK can
779+
# fall back to its credential-provider chain (instance metadata,
780+
# web-identity-token file, etc.). Pair with a ServiceAccount
781+
# `eks.amazonaws.com/role-arn` annotation on `webapp.serviceAccount`.
782+
useIam: false
783+
#
759784
# Secure credential management
760785
existingSecret: "" # Name of existing secret containing S3 credentials
761786
existingSecretAccessKeyIdKey: "access-key-id" # Key in existing secret containing access key ID

0 commit comments

Comments
 (0)