eho/register-referentie
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

Deploy the stack to the Talos cluster when a PR is merged to main #175

New Issue
Closed
opened 2026-09-18 13:40:30 +00:00 by not · 0 comments
not commented 2026-09-18 13:40:30 +00:00
Contributor
Copy Link
Copy Source

Context

The Helm chart (#25) and its CI gate (#168) landed, but deploying it is still a manual make k8s-images + make k8s-up from a laptop against a laptop VM. The lab server now runs a Talos VM too, and a Gitea action runner is deployed into it from Azure DevOps.

What

A .gitea/workflows/deploy.yaml that, on a push to main (i.e. a squash-merged PR) and on manual dispatch:

  1. tunnels the Talos API (6443), the in-cluster registry NodePort (30500) and the openbaar portal (30141) through the Fedora host (ssh -p 6667 user@labs.respellion.tech), because none of them is publicly reachable;
  2. builds and pushes this repo's nine images (make k8s-images) to the in-cluster registry;
  3. deploys with make k8s-reseed — seed + helm upgrade + re-run the idempotent bootstrap Jobs, which is also what keeps a changed Job template from wedging the upgrade;
  4. rolls the nine deployments, since dev is a mutable tag and helm sees no template change;
  5. smokes GET /openbaar/register through the openbaar portal.

PR CI is the merge gate, so the deploy workflow does not re-run the checks. Deploys queue rather than cancel: a killed helm upgrade leaves the release in pending-upgrade.

Out of scope

  • Ingress/TLS. Without a secure context the portals' PKCE flow can't run in a browser, so they still need make k8s-portals (runbook §5). Hostname + TLS is the upgrade path.
  • No approval gate — the PR review is the gate.

Done when

  • .gitea/workflows/deploy.yaml exists and a merge to main reaches green rollout status plus a 200 from the public register.
  • Required secrets/variables documented: TALOS_SSH_KEY, TALOS_KUBECONFIG, TALOS_VM_IP, TALOS_HOST.
  • docs/runbooks/kubernetes-talos.md gains the deploy section; docs/runbooks/ci.md points at it.
  • No new dependency, no §8 rule bent, so no ADR.
## Context The Helm chart (#25) and its CI gate (#168) landed, but deploying it is still a manual `make k8s-images` + `make k8s-up` from a laptop against a laptop VM. The lab server now runs a Talos VM too, and a Gitea action runner is deployed into it from Azure DevOps. ## What A `.gitea/workflows/deploy.yaml` that, on a push to `main` (i.e. a squash-merged PR) and on manual dispatch: 1. tunnels the Talos API (6443), the in-cluster registry NodePort (30500) and the openbaar portal (30141) through the Fedora host (`ssh -p 6667 user@labs.respellion.tech`), because none of them is publicly reachable; 2. builds and pushes this repo's nine images (`make k8s-images`) to the in-cluster registry; 3. deploys with `make k8s-reseed` — seed + `helm upgrade` + re-run the idempotent bootstrap Jobs, which is also what keeps a changed Job template from wedging the upgrade; 4. rolls the nine deployments, since `dev` is a mutable tag and helm sees no template change; 5. smokes `GET /openbaar/register` through the openbaar portal. PR CI is the merge gate, so the deploy workflow does not re-run the checks. Deploys queue rather than cancel: a killed `helm upgrade` leaves the release in `pending-upgrade`. ## Out of scope - Ingress/TLS. Without a secure context the portals' PKCE flow can't run in a browser, so they still need `make k8s-portals` (runbook §5). Hostname + TLS is the upgrade path. - No approval gate — the PR review is the gate. ## Done when - [ ] `.gitea/workflows/deploy.yaml` exists and a merge to `main` reaches green `rollout status` plus a 200 from the public register. - [ ] Required secrets/variables documented: `TALOS_SSH_KEY`, `TALOS_KUBECONFIG`, `TALOS_VM_IP`, `TALOS_HOST`. - [ ] `docs/runbooks/kubernetes-talos.md` gains the deploy section; `docs/runbooks/ci.md` points at it. - [ ] No new dependency, no §8 rule bent, so no ADR.
not added this to the Iteration 6 — Production Posture milestone 2026-09-18 13:40:30 +00:00
not added the type:chorearea:infra labels 2026-09-18 13:40:42 +00:00
not closed this issue 2026-09-18 13:54:00 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area:acl
area:bff
area:docs
area:domain
area:event-subscriber
area:infra
area:portal-behandel
area:portal-beheer
area:portal-openbaar
area:portal-self-service
area:projection
area:workflow
type:adr-proposal
type:bug
type:chore
type:slice
No labels area:infra type:chore
Milestone
No items
No Milestone Iteration 6 — Production Posture
Projects
Clear projects
No projects
Assignees
Clear assignees
eho (Edwin van den Houdt)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: eho/register-referentie#175