Repository navigation
feat: add kubernetes deployment, healthz endpoint, and image ci - #14
Merged
Merged
Conversation
Add a kustomize deployment under manifest/: one objgitd pod with a 16Gi pack-cache PVC on the default storage class, a Service for HTTP, git://, and SSH, a second Service for metrics, and probes against a new GET /healthz endpoint on the metrics listener. The metrics mux moves into newMetricsMux so the health endpoint is testable. NewPackCache now sweeps objgit-packs-* directories left by a run that died without Cleanup, which otherwise starve a persistent pack-cache volume. The Dockerfile cross-compiles through TARGETOS and TARGETARCH with the build stage pinned to BUILDPLATFORM, and docker.yml builds and publishes multi-arch images to ghcr.io on every commit, with a smoke test before any push. Assisted-by: GLM 5.3 via OpenCode Signed-off-by: Xe Iaso <xe@tigrisdata.com>
The secretGenerator now sets AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. The AWS SDK default chain reads these from the environment, which is also what the storage-go client falls back to when the TIGRIS_STORAGE_* overrides are unset. This matches the names every AWS tooling expects, and AWS_SESSION_TOKEN works for temporary credentials. Assisted-by: GLM 5.3 via OpenCode Signed-off-by: Xe Iaso <xe@tigrisdata.com>
The configMapGenerator now sets AWS_ENDPOINT_URL_S3, AWS_ENDPOINT_URL_IAM, and AWS_REGION=auto, so every AWS SDK client in the pod talks to Tigris. The storage-go wrapper pins the S3 endpoint itself, so the IAM endpoint matters most for the credential chain of IRSA. Assisted-by: GLM 5.3 via OpenCode Signed-off-by: Xe Iaso <xe@tigrisdata.com>
rbarabas
approved these changes
Sep 23, 2026
The secretGenerator now reads AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from files under manifest/secrets/, which .gitignore excludes, so real credentials cannot reach the repository. Kustomize refuses to build when the files are missing, which prevents an accidental deploy with placeholder values. The files must be written with printf '%s', because a trailing newline becomes part of the credential. Assisted-by: GLM 5.3 via OpenCode Signed-off-by: Xe Iaso <xe@tigrisdata.com>
Xe
pushed a commit
that referenced
this pull request
Sep 23, 2026
# [1.6.0](v1.5.1...v1.6.0) (2026-09-23) ### Features * add kubernetes deployment, healthz endpoint, and image ci ([#14](#14)) ([38e173f](38e173f)) Signed-off-by: Tigris Data <social@tigrisdata.com>
|
🎉 This PR is included in version 1.6.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
manifest/: oneobjgitdpod, a 16Gi pack-cache PVC on the default StorageClass, a Service exposing HTTP (80), git:// (9418), and SSH (22), a separate Service for metrics (9090), and startup/liveness/readiness probes.GET /healthzendpoint on the metrics listener, with a table-driven test..github/workflows/docker.yml: on every commit, build and publishlinux/amd64+linux/arm64images to ghcr.io (branch,sha-<commit>,latest, and release tags), with a container smoke test against/healthzbefore anything is pushed.objgit-packs-*cache directories atNewPackCachestartup, so a crash on a persistent pack-cache volume cannot starve the cache budget.docs/usage/kubernetes.md.Details
The Dockerfile now pins the build stage to
$BUILDPLATFORMand cross-compiles throughGOOS/GOARCH, so one native runner builds both platforms with no emulation. The pod mounts anemptyDirat/tmpbecause the root filesystem is read-only and the tigris storer stages pack writes withos.CreateTemp. The Deployment runs one replica with aRecreatestrategy, because the claim isReadWriteOnce. New GHCR packages start private, so make the package public or configure an imagePullSecret before applying.Test plan
go build ./...npm run formatgo test ./...passes;kubectl kustomize manifest/renders; native and cross-compiled images build and answer/healthz; workflow passes actionlint and zizmor.