Repository navigation
operator: deploy consumes values RENDERED from the Deployment record; chart renders the RAM/CPU envelope - #2686
Merged
Merged
Conversation
…ORD; the chart renders the RAM/CPU envelope
Increment 1 of 'node types drive the entire process': the hand-maintained per-environment
values file is gone from the deploy path. The Hosting plugin renders the chart's values from
the Hosting/Deployment record (HelmValues) and the job carries them as HOSTING_VALUES; run.sh
materialises them at $HOSTING_VALUES_FILE, and hosting-deploy accepts NOTHING ELSE — it refuses
a missing file, an empty file and a file without the HelmValues header, because any of those
would fall through to chart defaults (ghcr :latest, an in-cluster Postgres this fleet does not
run) and report success. $VALUES_FILE, the second hand-maintained fleet template mounted into
the job, is retired with it.
--config-file is retired too. It passed the flat Key=Value catalog lines to helm AS A VALUES
FILE; helm read a line like PluginCatalog:Registries:0:Name=Plugins as a mapping with a key
nobody templates, so a Provision would have deployed an instance with NO catalog wiring and
left hosting-verify-catalog to find out. The catalog now rides in the rendered values in the
chart's own shape (pluginCatalog.registries/sources/installByDefault).
--image is new and optional: a record that pins a tag rolls to it explicitly; otherwise the
deploy KEEPS the running image (the self-updater owns that field), and a first install with
no pin refuses rather than deploying the chart default — the same rule Memex's
helm-release.yml applies, now where the deploy actually happens.
The chart change is one block: resources.portal was a DEAD KEY — every overlay and
values.aks.yaml declared it, no template read it, and the live envelope came from an
out-of-band kubectl patch the next helm upgrade silently dropped. The standard-rung knob the
maintainer named first ('let the user choose ram / cpu') did nothing until now. Rendered only
when declared.
Tests: 5 new refusal cases in deploy/aks/operator/test/run-tests.sh, 33 passing. The
reproduction gate (Plugins + Memex companions) renders both live records through this chart:
memex byte-identical to its overlay (15 objects), memex-cloud identical except the
migration ConfigMap, where the OLD overlay named the wrong database.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the AKS hosting operator deploy flow to consume a single Helm values file rendered from the Hosting/Deployment record (materialized by run.sh), and updates the chart to actually render the portal’s CPU/memory envelope from values so resource sizing is no longer an out-of-band patch.
Changes:
- Add chart templating for
.Values.resources.portalto render containerresources:when declared. - Extend the operator job entrypoint (
run.sh) to materialize the record-rendered Helm values file fromHOSTING_VALUESintoHOSTING_VALUES_FILE. - Tighten
hosting-deployguardrails (reject empty/non-rendered values, remove--config-file, validate--image) and add refusal tests.
Reviewed changes
Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| deploy/helm/values.yaml | Updates operator env documentation to reflect the record-rendered values file path. |
| deploy/helm/templates/memex-portal/deployment.yaml | Renders portal container resources: from values to make sizing declarative. |
| deploy/aks/operator/test/run-tests.sh | Adds refusal coverage for empty/non-rendered values, unsafe --image, and removed --config-file. |
| deploy/aks/operator/bin/run.sh | Materializes base64-encoded record-rendered Helm values into a file for the deploy step. |
| deploy/aks/operator/bin/hosting-deploy | Removes --config-file, validates the rendered values header, and adds image preservation/pinning logic. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+222
to
+225
| {{- with ((.Values.resources).portal) }} | ||
| resources: | ||
| {{- toYaml . | nindent 12 }} | ||
| {{- end }} |
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Increment 1 of node types drive the entire process (core third). Do not merge in isolation — companions: MeshWeaver.Plugins
feat/record-driven-values(the model + projection), Systemorph/Memexfeat/record-driven-values(records migrated, overlays replaced by rendered output).What changes
hosting-deployaccepts ONLY the record-rendered values file ($HOSTING_VALUES_FILE, materialised byrun.shfromHOSTING_VALUES). Refuses a missing file, an empty file, and a file without theHelmValuesheader — each would fall through to chart defaults (ghcr :latest, in-cluster Postgres) and report success.$VALUES_FILE(the second hand-maintained fleet template) is retired.--config-fileretired. It passed flatKey=Valuecatalog lines to helm as a values file; helm readPluginCatalog:Registries:0:Name=Pluginsas a mapping nobody templates, so a Provision would have deployed with no catalog wiring. The catalog now rides in the rendered values in the chart's own shape.--imageoptional: a pinned record rolls explicitly; otherwise the deploy keeps the running image (the self-updater owns that field); a first install with no pin refuses rather than deploying the chart default — the same rulehelm-release.ymlapplies, now where the deploy happens.resources.portalwas a DEAD KEY. Every overlay andvalues.aks.yamldeclared it, no template read it; the live envelope came fromportal-patch.json, which the nexthelm upgradesilently dropped. Rendered now, only when declared.Tests
5 new refusal cases in
deploy/aks/operator/test/run-tests.sh— 33 passing.Reproduction gate (run locally through this chart)
memex-migration-configdiffersThe documented difference: the OLD memex-cloud overlay's migration section named database
memex(the other instance's) while its portal section servesmemexcloud. The record has oneDatabasefield feeding both.🤖 Generated with Claude Code