feat(helm): RFC-001 M5 — full-stack chart (frontier + frontlas + bundled Redis) - #104
Merged
Conversation
…bchart
Rework the existing frontier-only Helm chart into a complete, single-command
deployment for both data plane (frontier) and control plane (frontlas), with
an optional bundled bitnami/redis subchart. Defaults track the operator's
production-grade settings (M2/M3/M4) so the two install paths converge on
the same observable runtime behavior.
Chart.yaml
- Bump version 0.1.0 -> 1.2.5; appVersion 1.0.0 -> 1.2.5
- Add bitnami/redis dependency (condition: redis.enabled)
- Add description, keywords, maintainers, home, sources
values.yaml — restructured into four top-level sections:
frontier:
replicaCount, image, serviceAccount, podAnnotations/Labels,
podSecurityContext (nonRoot UID 65532, RuntimeDefault seccomp),
containerSecurityContext (drop ALL caps, no privEsc),
terminationGracePeriodSeconds (60), drainSeconds (50),
lifecycle.preStop (sleep 10), liveness/readinessProbe (TCP),
resources, service (servicebound/edgebound/controlplane),
ingress, autoscaling, nodeSelector, tolerations,
topologySpreadConstraints, affinity, extraEnv
frontlas:
same shape; readinessProbe defaults to HTTP /cluster/v1/health;
externalRedis subsection for BYO Redis when redis.enabled=false
observability:
frontier { enabled, port: 9091 }
frontlas { enabled, port: 9092 }
serviceMonitor:
enabled (off by default), namespace, interval, scrapeTimeout, labels
redis:
enabled (bitnami subchart), architecture, auth, master.persistence
Templates
- _helpers.tpl rewritten with per-component fullname / labels /
selectorLabels / serviceAccountName, plus pullPolicy / imageTag /
serviceFQDN / frontlas.redis helpers
- configmap_frontier.yaml + configmap_frontlas.yaml render configs via
`tpl` so values like ports / observability addr land in the actual
binary config
- deployment_frontier.yaml: rewritten for new helpers; injects
FRONTIER_DRAIN_SECONDS / NODE_NAME env; default preferred host
anti-affinity (overridable by .Values.frontier.affinity);
checksum/config annotation triggers pod restart on ConfigMap change
- deployment_frontlas.yaml (NEW): same shape; Redis credentials
injected via env (REDIS_PASSWORD as valueFrom.secretKeyRef when
bundled redis OR external passwordSecret is configured)
- service_frontier.yaml: separates servicebound + edgebound services;
optional headless metrics service paired with ServiceMonitor
- service_frontlas.yaml (NEW): single Service exposing controlplane
+ frontierplane ports; optional headless metrics service
- serviceaccount_frontier.yaml + serviceaccount_frontlas.yaml: per
component, automountServiceAccountToken=false
- servicemonitor.yaml (NEW): one file generating ServiceMonitor for
both components when serviceMonitor.enabled=true
- hpa_frontier.yaml: bump to autoscaling/v2; nest under
.Values.frontier.autoscaling
- ingress_frontier.yaml: simplified to networking.k8s.io/v1 only
Configs
- configs/frontier/frontier.yaml: now templated; wires servicebound /
edgebound listen ports, frontlas dial address (FQDN of the rendered
frontlas Service), and observability addr from values
- configs/frontlas/frontlas.yaml (NEW): templated; control_plane +
frontier_plane listen, observability addr; Redis specifics come
from env vars
Verified end-to-end on TKE v1.34:
- helm dependency update pulls bitnami/redis 20.13.4
- helm lint clean
- helm template renders 21 distinct objects (3 SA, 1 Secret, 5 CM,
7 Service, 2 Deployment, 1 StatefulSet, 1 NetworkPolicy, 1 PDB)
- helm install completes; all pods Running; Redis password injected
via valueFrom.secretKeyRef (no plaintext); nonRoot UID 65532;
preStop + drain env applied
- helm uninstall + namespace delete clean
Refs: docs/rfc/RFC-001-cloud-native-optimization.md (M5 — Helm chart
completeness, originally deferred from M4)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Cover the new dist/helm chart end-to-end as section 2.3: - Quick install with bundled bitnami/redis subchart - BYO external Redis via frontlas.externalRedis + passwordSecret - Knob reference table (replicaCount, image, registry, pullSecrets, edgebound serviceType, security context overrides, grace/drain, HPA, observability ports, ServiceMonitor toggle, redis.enabled) - Operator vs Helm decision matrix (declarative CR, Status conditions, TLS self-healing, multi-cluster isolation, bundled Redis, GitOps) - Hint to publish: helm package -> .tgz / helm push to OCI Verified with `npx next build`; /docs/operator still pre-renders. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
singchia
added a commit
that referenced
this pull request
May 2, 2026
First release after RFC-001 cloud-native optimization (PRs #103, #104, #105): - M1 — operator P0 bug fixes (TLS volume, Secret naming, frontier-plane port) - M2 — production baseline (PodOverrides, nonRoot images, Redis SecretRef, graceful shutdown, default probes / preStop / grace) - M3 — observability HTTP server (/healthz, /readyz, /metrics) on frontier:9091 and frontlas:9092 - M4 — Status Conditions, EventRecorder, CRD shortName fc, printcolumns - M5 — full-stack Helm chart (frontier + frontlas + bundled bitnami/redis), published at https://singchia.github.io/frontier Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
把
dist/helm/从只能装 frontier 的半成品，重构成可以一键装 frontier + frontlas + Redis 的完整 Helm chart。用户从此可以直接helm install frontier dist/helm拿到与 Operator 路径同等水平的运行时配置。PR #103（Operator 路径）已含 M1+M2+M3+M4，本 PR 补 M5 — Helm chart 完整化（在 PR #103 里被列为推迟事项）。依赖 PR #103：本 PR base =
feat/rfc-001-m1，因为 chart 用到 PR #103 里的 nonRoot Dockerfile 和 observability binary 改动。📦 已发布的 Chart 包
Helm chart 1.2.5-rc1 GitHub Release (pre-release，绑定本 PR HEAD)
frontier-1.2.5.tgz884dcc5c2cb0b03e3065ecf9ea5d8f8e56feabbcb9f99975d93f6f9f6dd402c4index.yaml主要交付
Chart.yaml
0.1.0→1.2.5，appVersion1.0.0→1.2.5bitnami/redisdependency（条件redis.enabled）values.yaml — 4 段重构
frontier— replicaCount / image / SA / podAnnotations / Labels / podSecurityContext (nonRoot UID 65532) / containerSecurityContext (drop ALL caps) / terminationGracePeriodSeconds (60) / drainSeconds (50) / lifecycle.preStop / liveness/readinessProbe (TCP) / resources / service / ingress / autoscaling / 调度 / extraEnvfrontlas— 同结构；readinessProbe 默认 HTTP /cluster/v1/health；外置 Redis 配置入externalRedisobservability— frontier 9091 / frontlas 9092 默认开启 +serviceMonitor开关redis— 内嵌 bitnami subchart 默认开启Templates
_helpers.tpl全重写：每组件独立 fullname / labels / selectorLabels / SA name；新增 pullPolicy / imageTag / serviceFQDN /frontier.frontlas.redis助手configmap_frontier.yaml+ 新configmap_frontlas.yaml：用tpl渲染配置文件，端口 / observability addr / frontlas dial 都从 values 来deployment_frontier.yaml重写：注FRONTIER_DRAIN_SECONDS+NODE_NAMEenv；默认 preferred host 反亲和；ConfigMap checksum 触发 rolloutdeployment_frontlas.yaml：Redis 凭据通过valueFrom.secretKeyRef注入（内嵌 redis 走<release>-redisSecret，外置 redis 走用户 Secret）service_frontier.yaml+ 新service_frontlas.yaml：分别 ClusterIP（servicebound、frontlas controlplane+frontierplane）+ NodePort（edgebound）+ 可选 headless metrics serviceserviceaccount_frontier.yaml+serviceaccount_frontlas.yaml（automountServiceAccountToken: false）servicemonitor.yaml：开关受serviceMonitor.enabled控制hpa_frontier.yaml：升autoscaling/v2ingress_frontier.yaml：清理至networking.k8s.io/v1Configs
configs/frontier/frontier.yaml：现支持 templating；frontlas.dial.addrs自动指向渲染出的 frontlas Service FQDN；observability段从 values 注入configs/frontlas/frontlas.yaml：同样模板化；Redis 具体由 env 注入文档
/docs/operator加 §2.3 "Install with Helm"，含：helm package→.tgz）Test plan
helm dependency update拉到 bitnami/redis 20.13.4helm lint通过（仅 1 条 INFO：缺 chart icon）helm template渲染 21 个对象（3 SA / 1 Secret / 5 CM / 7 Service / 2 Deploy / 1 STS / 1 NetworkPolicy / 1 PDB）helm package产出frontier-1.2.5.tgz（114 601 字节）helm install：frontier + frontlas + redis-master 都 1/1 Running；nonRoot UID 65532 应用；Redis 密码走valueFrom.secretKeyRef不留明文；preStop + drain env 完整；7 个 Service 全渲染helm uninstall干净helm pullfrom GitHub Release URL 拿到的 SHA256 与本地构建一致 (884dcc5c…)npx next build（website）通过兼容性 / 升级注意
0.1.0→1.2.5)：原 chart 用户需要全量 review values。values.yaml 顶层 schema 完全变了frontier.podSecurityContext: {}+containerSecurityContext: { runAsNonRoot: false }可关--set redis.master.persistence.enabled=false可关（开发环境）Chart.lock入库，charts/目录在.gitignore（执行helm dependency update自动拉）--set frontier.image.tag=1.1.0 --set frontlas.image.tag=1.1.0临时跑老版（PR feat: RFC-001 cloud-native optimization (M1+M2+M3+M4 + docs) #103 的镜像构建合并后即可去掉）关联
feat/rfc-001-m1，本 PR 应在 PR feat: RFC-001 cloud-native optimization (M1+M2+M3+M4 + docs) #103 合并后再合（或 rebase 到 main）docs/rfc/RFC-001-cloud-native-optimization.md(M5)🤖 Generated with Claude Code