go-loose/deploy/helm/go-loose

Go Loose Helm chart

This is the canonical Go Loose chart. The central deploy script and the Go Loose CI workflow both use this directory.

Environment profiles

Use one profile file per environment:

Environment	Namespace	Profile	Ingress class	TLS issuer
dev	go-insane-dev	values-dev.yaml	nginx	letsencrypt-staging
tst	go-insane-tst	values-tst.yaml	nginx	letsencrypt-staging
prd	go-insane-prd	values-prd.yaml	nginx	letsencrypt-prod
lcl	go-insane-lcl	values-lcl.yaml	Traefik	local TLS

The namespace is supplied by Helm's release namespace; it is not hard-coded in the chart templates.

Runtime Secret contract

Before a release, the target namespace must contain go-loose-runtime with:

Key	Used for
postgresql-password	PostgreSQL application user's password
postgres-password	PostgreSQL administrator password
database-url	GO_LOOSE_DATABASE_URL
session-secret	GO_LOOSE_SESSION_SECRET

The chart reads these values using Kubernetes secretKeyRef and the PostgreSQL subchart's existingSecret support. Runtime credentials are not stored in chart values or Helm release configuration.

To provision/update the secret from protected files without printing its values:

/home/dnoulet/go/ops/scripts/apply-go-loose-secret.sh \
  <dev|tst|prd|lcl> \
  /secure/path/postgresql-password \
  /secure/path/database-url \
  /secure/path/session-secret \
  [kubeconfig]

The input files should contain only the required value (no trailing newline). The helper creates the environment namespace if it is not present, then applies the Secret. It does not print secret values.

The PRD CI deployment script maintains the same secret contract automatically. Do not commit the input files or put their contents in a Helm values file.

Tenant wildcard ingress

Go Guess signs in through tenant-specific hosts such as nmbs.auth.dev-urpi.be and nmbs.auth.urpi.be. The chart therefore creates a second ingress for *.auth-<env>... and requires a separate TLS Secret named go-loose-wildcard-tls in the same namespace. The central deploy script and PRD CI check for this Secret before installing the release.

Provision it from a trusted wildcard certificate and private key:

kubectl --kubeconfig <kubeconfig> --namespace go-insane-<env> create secret tls \
  go-loose-wildcard-tls --cert=/secure/path/wildcard.crt \
  --key=/secure/path/wildcard.key

The PRD letsencrypt-prod issuer documented for the apex ingress uses HTTP-01; HTTP-01 cannot issue wildcard certificates. Obtain this certificate through DNS-01 or the approved certificate authority, then provision the Secret. Do not put the private key in the chart, repository, or Helm release values.

Validation

helm lint . -f values-dev.yaml
helm lint . -f values-tst.yaml
helm lint . -f values-prd.yaml
helm lint . -f values-lcl.yaml