EMRY-063: Helm chart and container image #115

Merged

vxfemboy merged 3 commits from emry-063-helm into main

2026-07-02 23:25:37 +00:00

vxfemboy commented

2026-07-02 23:07:59 +00:00

(Migrated from github.com)

What

A container image and a Helm chart for running the Emry web dashboard on Kubernetes.

Dockerfile — multi-stage: builds emry-cli on rust:1.88, copies the emry binary into a slim debian:bookworm-slim runtime (keeps a shell for nvidia-smi; ca-certificates for webhook TLS). Runs non-root (uid 10001) under tini, exposes 8787, serves emry web --project /logs --host 0.0.0.0.
deploy/helm/emry/ — Deployment (liveness/readiness on /healthz, non-root + readOnlyRootFilesystem, dropped caps), Service, optional Ingress, optional Secret, ServiceAccount, values.yaml, NOTES.txt.

Key wiring

Binds 0.0.0.0 (via the --host flag from #113) so kubelet probes and the Service — which hit the pod IP, not loopback — can reach the dashboard. Configurable via host in values.
Logs volume at /logs: pick logs.existingClaim (PVC, mounted read-only), logs.hostPath, or an ephemeral emptyDir (NOTES warns the dashboard will be empty).
Auth: EMRY_AUTH_TOKEN (from #113) sourced from a Secret — either chart-created from auth.token, or a user auth.existingSecret. Unset ⇒ unauthenticated.

Validation

helm lint clean (only the cosmetic "icon recommended" info) and helm template renders for default values and for the auth-token + ingress + PVC permutation — both run in a new CI helm job (azure/setup-helm, matching the repo's tag-pin convention). Rendered output confirms --host 0.0.0.0 and the EMRY_AUTH_TOKEN secretKeyRef. docker build not run in CI (slow); the Dockerfile is a standard multi-stage build.

Closes #44

## What A container image and a Helm chart for running the Emry web dashboard on Kubernetes. - **`Dockerfile`** — multi-stage: builds `emry-cli` on `rust:1.88`, copies the `emry` binary into a slim `debian:bookworm-slim` runtime (keeps a shell for `nvidia-smi`; `ca-certificates` for webhook TLS). Runs non-root (uid 10001) under `tini`, exposes 8787, serves `emry web --project /logs --host 0.0.0.0`. - **`deploy/helm/emry/`** — Deployment (liveness/readiness on `/healthz`, non-root + `readOnlyRootFilesystem`, dropped caps), Service, optional Ingress, optional Secret, ServiceAccount, `values.yaml`, `NOTES.txt`. ## Key wiring - **Binds `0.0.0.0`** (via the `--host` flag from #113) so kubelet probes and the Service — which hit the pod IP, not loopback — can reach the dashboard. Configurable via `host` in values. - **Logs volume** at `/logs`: pick `logs.existingClaim` (PVC, mounted read-only), `logs.hostPath`, or an ephemeral `emptyDir` (NOTES warns the dashboard will be empty). - **Auth**: `EMRY_AUTH_TOKEN` (from #113) sourced from a Secret — either chart-created from `auth.token`, or a user `auth.existingSecret`. Unset ⇒ unauthenticated. ## Validation `helm lint` clean (only the cosmetic "icon recommended" info) and `helm template` renders for default values and for the auth-token + ingress + PVC permutation — both run in a new CI `helm` job (`azure/setup-helm`, matching the repo's tag-pin convention). Rendered output confirms `--host 0.0.0.0` and the `EMRY_AUTH_TOKEN` `secretKeyRef`. `docker build` not run in CI (slow); the Dockerfile is a standard multi-stage build. Closes #44