mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-19 10:33:29 +00:00
7c9a572349
The agent_runtime verify-only build pointed its registry buildcache at
ghcr.io/<owner>/pulse-agent, a package no workflow publishes. A cache ref
creates the package it points at, so every release recreated it and the
repository's Packages sidebar advertised an empty pulse-agent entry that
reads like a pullable agent image sitting beside the real pulse,
pulse-control-plane and pulse-chart/pulse packages. The only release tag it
ever carried is a stray v6.0.0-rc.3.
Move the cache to ghcr.io/<owner>/pulse:agent-buildcache, alongside the
runtime stage's existing pulse:buildcache tag, so it lives in the package
that actually ships and shares backend-builder layers with the runtime
build.
TestAgentBuildCacheDoesNotResurrectPulseAgentPackage locks this in. It scans
every workflow for registry-qualified refs to the pulse-agent package,
collapsing ${{ }} expressions first so an interpolated owner cannot hide one
behind its spaces, and asserts both the new cache target and the chart's
published agent image default. Verified red on a restored buildcache ref and
red again on a ref hidden behind ${{ github.repository_owner }}.
Two stale claims corrected while here. The chart values comment said the old
agent.image default was never published, when it did carry v6.0.0-rc.3. The
deployment-installability contract called rcourtman/pulse the only image
publish-docker.yml pushes, when the same workflow also pushes the MSP
pulse-control-plane image. The contract now also forbids buildcache
references to the pulse-agent package, which is what let this regress.
Deleting the orphaned package itself remains a manual GHCR step.
205 lines
4.8 KiB
YAML
205 lines
4.8 KiB
YAML
# Default values for the Pulse Helm chart.
|
|
# This file can be used as-is for a minimal installation or as a reference when
|
|
# overriding values (for example with `-f custom-values.yaml`).
|
|
|
|
replicaCount: 1
|
|
|
|
# Deployment strategy. Default is RollingUpdate, but Recreate is recommended
|
|
# when using ReadWriteOnce (RWO) persistent volumes to avoid Multi-Attach errors.
|
|
strategy:
|
|
type: RollingUpdate
|
|
|
|
image:
|
|
repository: rcourtman/pulse
|
|
# Overrides the image tag whose default is the chart appVersion.
|
|
tag: ""
|
|
pullPolicy: IfNotPresent
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
# OpenShift compatibility. When enabled, the server lets the namespace SCC
|
|
# assign UID/GID/fsGroup values instead of pinning the chart defaults. The
|
|
# optional Kubernetes agent is a single-replica, socket-free cluster reader.
|
|
openShift:
|
|
# -- Use SCC-compatible server and agent security defaults.
|
|
enabled: false
|
|
kubernetesAgent:
|
|
# -- Deploy the socket-free OpenShift Kubernetes collector.
|
|
enabled: false
|
|
# -- Stable logical agent ID; defaults to the release fullname plus `-openshift`.
|
|
clusterID: ""
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
name: ""
|
|
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
enabled: true
|
|
fsGroup: 1000
|
|
|
|
containerSecurityContext:
|
|
enabled: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 7655
|
|
annotations: {}
|
|
loadBalancerIP: ""
|
|
externalTrafficPolicy: Cluster
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
hosts:
|
|
- host: pulse.local
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: ""
|
|
storageClass: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 8Gi
|
|
annotations: {}
|
|
|
|
server:
|
|
env:
|
|
- name: TZ
|
|
value: UTC
|
|
envFrom: []
|
|
extraEnv: []
|
|
extraEnvFrom: []
|
|
secretEnv:
|
|
create: false
|
|
name: ""
|
|
data: {}
|
|
keys: []
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
podSecurityContext: {}
|
|
securityContext: {}
|
|
extraVolumes: []
|
|
extraVolumeMounts: []
|
|
resources: {}
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
livenessProbe:
|
|
enabled: true
|
|
path: /
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
enabled: true
|
|
path: /
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
agent:
|
|
# Optional in-cluster agent workload.
|
|
# This deploys the unified `pulse-agent` in container-monitoring mode.
|
|
enabled: false
|
|
kind: DaemonSet # Supported: DaemonSet | Deployment
|
|
replicaCount: 1
|
|
serviceAccount:
|
|
create: false
|
|
name: ""
|
|
annotations: {}
|
|
rbac:
|
|
# -- Create the read-only Kubernetes collector ClusterRole and binding.
|
|
create: false
|
|
# -- Override the Kubernetes collector ClusterRole name.
|
|
name: ""
|
|
image:
|
|
# Defaults to the main Pulse image; the runtime stage now ships an arch-
|
|
# resolved /usr/local/bin/pulse-agent symlink so the same image can serve
|
|
# both server and agent workloads. The previous default
|
|
# (ghcr.io/rcourtman/pulse-agent) is not a maintained image: no release
|
|
# workflow pushes it, and the only tag it ever carried was v6.0.0-rc.3.
|
|
repository: rcourtman/pulse
|
|
tag: ""
|
|
pullPolicy: IfNotPresent
|
|
# Override the main image's server ENTRYPOINT so this pod runs as a unified
|
|
# agent. /usr/local/bin/pulse-agent is the arch-resolved symlink baked into
|
|
# the runtime stage. Override `agent.command` if you ship a custom image
|
|
# with a different agent binary path.
|
|
command:
|
|
- /usr/local/bin/pulse-agent
|
|
env:
|
|
- name: PULSE_URL
|
|
value: http://pulse:7655
|
|
envFrom: []
|
|
extraEnv: []
|
|
extraEnvFrom: []
|
|
secretEnv:
|
|
create: false
|
|
name: ""
|
|
data: {}
|
|
keys: []
|
|
args:
|
|
- --enable-docker
|
|
- --enable-host=false
|
|
resources: {}
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
podSecurityContext: {}
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
privileged: false
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
dockerSocket:
|
|
enabled: true
|
|
path: /var/run/docker.sock
|
|
hostPathType: Socket
|
|
extraVolumes: []
|
|
extraVolumeMounts: []
|
|
healthPort: 9191
|
|
livenessProbe:
|
|
enabled: true
|
|
path: /healthz
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
enabled: true
|
|
path: /readyz
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
|
|
# Monitoring configuration
|
|
# Note: The ServiceMonitor targets the main HTTP service (7655). Prometheus metrics are
|
|
# served on 9091 by the Pulse server, so scraping requires an additional Service.
|
|
monitoring:
|
|
serviceMonitor:
|
|
enabled: false
|
|
interval: 30s
|
|
scrapeTimeout: 10s
|
|
path: /metrics
|
|
labels: {}
|
|
relabelings: []
|
|
metricRelabelings: []
|