feat: configure the eduide cluster and its two environments for parma - #129
Merged
Conversation
Everything here was checked against the live cluster rather than assumed. The manifest said as much about itself: it was written speculatively before parma existed. clusters/eduide.yaml storageClassName was `local`; the only class on the node is `local-path`, so every PVC would have stayed unbound. acmeHttp was false, which meant nothing would have issued the landing, service and instance certificates at all. Now true, with the contact address the other clusters use. The cluster has NO load balancer: k3s runs without servicelb and there is no MetalLB, so a Service of type LoadBalancer sits pending for ever. Since it is a single node and DNS points at that node, Envoy binds the host's :80 and :443 directly - hostNetwork, useListenerPortAsContainerPort so the ports are not shifted to 10080/10443, and NET_BIND_SERVICE because the container runs as non-root. Nothing else owns a GatewayClass here, so the chart creates one named `eduide` along with its EnvoyProxy. environments Bonn offers Javascript, Mannheim the TH Mannheim Java 25 image, and the other seven apps are removed rather than hidden so nothing is rendered, preloaded or offered for them. Both persist workspaces: `landingPage.ephemeralStorage: false`, because the chart-wide default is true and would discard the volume with the session. Retention is 14 days for Bonn and 150 for Mannheim. Monitoring is stated explicitly on both. parma already has cattle-monitoring-system, cattle-dashboards and the PodMonitor CRD. Mannheim's image only exists as pr-170 until EduIDE#170 merges, so its deploy passes ide_tag until then. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019qeiQRFu8xAMRYWPdZewjG
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe change provisions the EduIDE cluster with local storage, ACME TLS, Gateway API, and host-networked Envoy settings. Bonn and Mannheim now define persistent workspaces, environment-specific applications, workspace garbage collection, and monitoring. ChangesEduIDE provisioning
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The PR configures the cluster and its two environments without any actionable merge-blocking risk remaining; it is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
clusters/eduide.yamlwas written before parma existed and said so. Everything below was checked against the live cluster.What was wrong
storageClassNamelocallocal-path- every PVC would have stayed unboundacmeHttpfalsetrue- nothing would have issued the landing, service or instance certificatesacmeEmailacmeHttpis trueenvoyexistseduideThe cluster has no load balancer
k3s runs without servicelb (no DaemonSets in
kube-system) and there is no MetalLB, so aLoadBalancerService would sit pending for ever. It is a single node and DNS points at that node, so Envoy binds the host ports directly:All three are needed together: host networking alone still lands on 10080, and binding :80 as the non-root envoy user fails without the capability.
Environments
Bonn offers Javascript, Mannheim the TH Mannheim Java 25 image. The other seven are removed rather than hidden, so nothing is rendered, preloaded or offered for them. Verified by rendering:
Workspace persistence on both:
landingPage.ephemeralStorage: false. The chart-wide default in_base.yamlistrue, which would discard the volume with the session - so persistence needs saying, it is not the default. Retention is 14 days for Bonn and 150 days for Mannheim viaWORKSPACE_TTL.Monitoring stated explicitly on both. parma already has
cattle-monitoring-system,cattle-dashboardsand the PodMonitor CRD.The duplicate-key check earned its place
Both files already had a
landingPage:block. My first version appended a second one, which YAML resolves last-wins - silently droppinginfoTitleandfooterLinks.test-deploy-logic.shfailed on it immediately. Merged into the existing block;infoTitleandfooterLinksconfirmed preserved.Done outside this PR
cert-manager on parma had no Gateway API support - no
--enable-gateway-api, no config - so every Gateway-solved HTTP-01 challenge would have hung while the Gateway reported healthy. Enabled in place (enableGatewayAPI: trueis live and the controller restarted onto it), and the ansible playbook atplaybooks/k8s/parma/platform/00-helmcharts.yamlupdated so a rebuild keeps it.Still blocked
Mannheim's image exists only as
pr-170until EduIDE#170 merges, so its deploy passeside_tagexplicitly. Bonn deploys without authentication by decision; it must not be advertised until its realm is settled.test-deploy-logic.shALL PASS, both cluster manifests validate.Summary by CodeRabbit
New Features
Bug Fixes