Add helm charts for individual components - #2820
Merged
Merged
Conversation
DinithHerath
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Induwara04,
Krishanx92,
PasanT9,
Piumal1999,
RakhithaRR,
Tharsanan1,
Thushani-Jayasekera,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
lasanthaS,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub,
tharindu1st and
thivindu
as code owners
July 23, 2026 09:14
Contributor
|
Warning Review limit reached
Next review available in: 38 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds three standalone Helm charts with configurable Kubernetes resources, shared helpers, TLS, persistence, autoscaling, local overrides, packaging rules, and manual workflows that validate, package, publish OCI artifacts to GHCR, create tags and draft releases, and write workflow summaries. ChangesHelm chart suite
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (4)
kubernetes/helm/ai-workspace-ui-helm-chart/templates/issuer.yaml (1)
3-21: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winDangling issuer reference when
createIssuer=truewith a non-Issuerkind.This template only creates the self-signed
IssuerwhenissuerRef.kind == "Issuer".certificate.yaml(L24-28) references{{ include "apip.aiWorkspace.fullname" . }}-selfsigned-issuerwhenevercreateIssueris true, regardless ofissuerRef.kind. If an operator setscreateIssuer: truewithissuerRef.kind: ClusterIssuer, no Issuer/ClusterIssuer is created but the Certificate still references the name — cert-manager will fail to issue silently, with no chart-level error surfaced. Consider afailguard here (or in certificate.yaml) whencreateIssueris true butissuerRef.kind != "Issuer".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/issuer.yaml` around lines 3 - 21, Update the issuer template guards around the self-signed issuer creation to validate that when $tls.certManager.createIssuer is true, $tls.certManager.issuerRef.kind is "Issuer"; otherwise fail Helm rendering with a clear configuration error. Preserve the existing issuer creation behavior for valid "Issuer" configurations.kubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yaml (1)
106-107: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winNo guard against multi-replica scaling with in-memory sessions.
sessionStoredefaults tomemoryandhpa.minReplicasdefaults to 2 once HPA is enabled (values.yaml L106-108, L236). Nothing stops an operator from enablinghpawithout also changingsessionStore, silently breaking sessions once traffic is spread across replicas without sticky routing. Consider afailguard (mirroring thepodDisruptionBudgetmutual-exclusion check inpdb.yaml) whenhpa.enabledanddeployment.replicaCount/hpa.minReplicas> 1 whilesessionStore == "memory".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yaml` around lines 106 - 107, The deployment template lacks a validation guard for multiple replicas using in-memory sessions. Add a Helm fail guard near the SESSION_STORE configuration that rejects sessionStore "memory" when hpa.enabled with hpa.minReplicas greater than 1 or deployment.replicaCount greater than 1, while allowing single-replica deployments and external session stores; mirror the established podDisruptionBudget validation pattern.kubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yaml (1)
27-27: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winStatic
replicasfights the HPA on everyhelm upgrade.When
hpa.enabledis true, keeping a staticreplicasfield on the Deployment causes Helm to reset the replica count to$deployment.replicaCounton every upgrade, overriding whatever the HPA had scaled to. Consider omittingreplicaswhen the HPA is enabled.♻️ Proposed fix
- replicas: {{ $deployment.replicaCount }} + {{- if not $dp.hpa.enabled }} + replicas: {{ $deployment.replicaCount }} + {{- end }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yaml` at line 27, Update the Deployment template around the replicas field to render replicas only when the HPA is disabled; when hpa.enabled is true, omit the field so Helm does not reset the HPA-managed count during upgrades.kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl (1)
189-217: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftCross-chart secret helpers duplicated per chart — drift risk.
apip.aiWorkspace.secretName/apip.developerPortal.secretNamearen't called anywhere in this chart's own templates; they exist so the sibling ai-workspace/developer-portal charts can resolve secrets identically. Since Helm doesn't support sharing_helpers.tplacross independently-packaged charts, this whole file is likely copied verbatim into each of the three charts — any future fix (like thedefault truebug above) has to be applied in three places or they silently diverge.Consider extracting this into a Helm library chart shared as a dependency instead of copy-pasting
_helpers.tpl.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl` around lines 189 - 217, Extract the shared secret-name helpers, including apip.platformApi.secretName, apip.aiWorkspace.secretName, and apip.developerPortal.secretName, into a Helm library chart and declare it as a dependency of all three charts. Update each chart to consume the library helpers instead of maintaining copied definitions in its own _helpers.tpl, preserving the existing values lookup and required-secret validation behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-workspace-ui-helm-release.yml:
- Around line 58-59: Replace direct interpolation of inputs.appVersion in the
Helm release workflows with an environment-passed value, validate it against an
allowed version format, and update Chart.yaml without embedding untrusted input
in Bash source. Apply this change at
.github/workflows/ai-workspace-ui-helm-release.yml:58-59,
.github/workflows/developer-portal-ui-helm-release.yml:58-59, and
.github/workflows/platform-api-helm-release.yml:58-59.
- Around line 57-60: Update the release-source contract in
.github/workflows/ai-workspace-ui-helm-release.yml:57-60,
.github/workflows/developer-portal-ui-helm-release.yml:57-60, and
.github/workflows/platform-api-helm-release.yml:57-60 so the version and
optional appVersion used to publish each Helm chart are also represented in the
tagged source; either validate that requested inputs already match each chart’s
checked-in Chart.yaml metadata or commit the metadata changes before creating
the tag.
- Around line 49-52: Pin the Helm version instead of using latest in the Install
Helm step for .github/workflows/ai-workspace-ui-helm-release.yml lines 49-52,
.github/workflows/developer-portal-ui-helm-release.yml lines 49-52, and
.github/workflows/platform-api-helm-release.yml lines 49-52, using the same
explicit version across all three workflows.
In `@kubernetes/helm/.gitignore`:
- Around line 3-6: Update the ignore patterns in the Helm .gitignore to use the
actual ai-workspace-ui-helm-chart/ and developer-portal-ui-helm-chart/ directory
names, preserving both charts/ and Chart.lock exclusions so dependency-update
artifacts remain ignored.
In `@kubernetes/helm/ai-workspace-ui-helm-chart/values.yaml`:
- Around line 124-136: Change the default service.type from LoadBalancer to
ClusterIP in the service configuration, keeping external exposure as an explicit
operator opt-in while preserving the existing service settings and
development-mode defaults.
In `@kubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tpl`:
- Around line 27-35: Update the fullname helpers apip.platformApi.fullname,
apip.aiWorkspace.fullname, and apip.developerPortal.fullname to truncate the
included apip.fullname base to the available length before appending each
component suffix, then trim any trailing hyphen. Preserve the distinct
platform-api, ai-workspace, and developer-portal suffixes in the generated
names.
In `@kubernetes/helm/developer-portal-ui-helm-chart/values-local.yaml`:
- Around line 2-3: Update the usage command in values-local.yaml to reference
values-local.yaml relative to the developer-portal-ui-helm-chart directory and
include the required secrets overlay file, so standalone Helm installation
renders successfully from the documented invocation.
In `@kubernetes/helm/developer-portal-ui-helm-chart/values.yaml`:
- Around line 19-20: Update the chart defaults in values.yaml so developmentMode
is false, role validation is enabled, and Platform API TLS verification is not
skipped; move only the development-specific overrides needed for local
development into values-local.yaml, preserving the existing configuration keys
and structure.
- Around line 150-161: Update the service defaults in values.yaml to use
ClusterIP instead of LoadBalancer, and add a default-off administrative opt-in
that gates NodePort and LoadBalancer exposure. Provide safe built-in
private-range source restrictions with configuration for operator extensions,
ensuring tenant values cannot widen exposure unless the explicit administrative
setting is enabled.
In `@kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl`:
- Around line 132-142: Update the tlsEnabled handling in
apip.platformApi.internalURL to distinguish an absent value from an explicit
false; retain true as the fallback only when global.platformApi.tlsEnabled is
unset, and pass the resulting boolean to ternary so false selects http.
In `@kubernetes/helm/platform-api-helm-chart/templates/certificate.yaml`:
- Around line 24-29: Reject incompatible createIssuer and issuerRef.kind
settings in certificate.yaml: when createIssuer is true, require issuerRef.kind
to be Issuer or force the generated Certificate reference to kind Issuer. Align
the rendering gate in
kubernetes/helm/platform-api-helm-chart/templates/issuer.yaml lines 3-4 with
this Certificate contract; update both sites accordingly.
In `@kubernetes/helm/platform-api-helm-chart/templates/configmap.yaml`:
- Around line 18-33: Update the ConfigMap TOML emitted by the platform API
configuration template to use the 0.12.0 schema rooted under platform_api,
including nested database, auth.jwt, and server.http sections as expected by
config.go. Move the existing top-level keys into their corresponding
platform_api paths and ensure the service port is rendered as a numeric TOML
value rather than a quoted string. Preserve the current conditional PostgreSQL
fields while placing them under platform_api.database.
---
Nitpick comments:
In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yaml`:
- Around line 106-107: The deployment template lacks a validation guard for
multiple replicas using in-memory sessions. Add a Helm fail guard near the
SESSION_STORE configuration that rejects sessionStore "memory" when hpa.enabled
with hpa.minReplicas greater than 1 or deployment.replicaCount greater than 1,
while allowing single-replica deployments and external session stores; mirror
the established podDisruptionBudget validation pattern.
In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/issuer.yaml`:
- Around line 3-21: Update the issuer template guards around the self-signed
issuer creation to validate that when $tls.certManager.createIssuer is true,
$tls.certManager.issuerRef.kind is "Issuer"; otherwise fail Helm rendering with
a clear configuration error. Preserve the existing issuer creation behavior for
valid "Issuer" configurations.
In `@kubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yaml`:
- Line 27: Update the Deployment template around the replicas field to render
replicas only when the HPA is disabled; when hpa.enabled is true, omit the field
so Helm does not reset the HPA-managed count during upgrades.
In `@kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl`:
- Around line 189-217: Extract the shared secret-name helpers, including
apip.platformApi.secretName, apip.aiWorkspace.secretName, and
apip.developerPortal.secretName, into a Helm library chart and declare it as a
dependency of all three charts. Update each chart to consume the library helpers
instead of maintaining copied definitions in its own _helpers.tpl, preserving
the existing values lookup and required-secret validation behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6a1180d3-1489-4241-8faf-332123d1a1c7
📒 Files selected for processing (42)
.github/workflows/ai-workspace-ui-helm-release.yml.github/workflows/developer-portal-ui-helm-release.yml.github/workflows/platform-api-helm-release.ymlkubernetes/helm/.gitignorekubernetes/helm/ai-workspace-ui-helm-chart/.helmignorekubernetes/helm/ai-workspace-ui-helm-chart/Chart.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tplkubernetes/helm/ai-workspace-ui-helm-chart/templates/certificate.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/configmap.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/issuer.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/pdb.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/service.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values-local.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values.yamlkubernetes/helm/developer-portal-ui-helm-chart/.helmignorekubernetes/helm/developer-portal-ui-helm-chart/Chart.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tplkubernetes/helm/developer-portal-ui-helm-chart/templates/certificate.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/configmap.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/hpa.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/issuer.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/pdb.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/pvc.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/service.yamlkubernetes/helm/developer-portal-ui-helm-chart/values-local.yamlkubernetes/helm/developer-portal-ui-helm-chart/values.yamlkubernetes/helm/platform-api-helm-chart/.helmignorekubernetes/helm/platform-api-helm-chart/Chart.yamlkubernetes/helm/platform-api-helm-chart/templates/_helpers.tplkubernetes/helm/platform-api-helm-chart/templates/certificate.yamlkubernetes/helm/platform-api-helm-chart/templates/configmap.yamlkubernetes/helm/platform-api-helm-chart/templates/deployment.yamlkubernetes/helm/platform-api-helm-chart/templates/hpa.yamlkubernetes/helm/platform-api-helm-chart/templates/issuer.yamlkubernetes/helm/platform-api-helm-chart/templates/pdb.yamlkubernetes/helm/platform-api-helm-chart/templates/pvc.yamlkubernetes/helm/platform-api-helm-chart/templates/service.yamlkubernetes/helm/platform-api-helm-chart/values-local.yamlkubernetes/helm/platform-api-helm-chart/values.yaml
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml (1)
21-42: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winGuard against an HPA with no metrics configured.
If
hpa.enabledis true but none oftargetCPUUtilizationPercentage,targetMemoryUtilizationPercentage, orcustomMetricsare set, the rendered HPA has nometricsfield at all and will never scale (silently inert rather than failing loudly).pdb.yamlin this same chart already usesfailto enforce valid config combinations — consider the same pattern here.♻️ Suggested guard
{{- if and $ui.deployment.enabled $hpa.enabled }} +{{- if not (or $hpa.targetCPUUtilizationPercentage $hpa.targetMemoryUtilizationPercentage $hpa.customMetrics) }} +{{- fail "ui.hpa: at least one of targetCPUUtilizationPercentage, targetMemoryUtilizationPercentage, or customMetrics must be set when hpa.enabled=true" }} +{{- end }} apiVersion: autoscaling/v2🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml` around lines 21 - 42, Guard the HPA template’s metrics configuration by failing during rendering when hpa.enabled is true but targetCPUUtilizationPercentage, targetMemoryUtilizationPercentage, and customMetrics are all unset. Add the validation near the existing metrics condition in hpa.yaml, using Helm’s fail pattern like pdb.yaml, while preserving the current rendering for valid metric configurations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml`:
- Around line 21-42: Guard the HPA template’s metrics configuration by failing
during rendering when hpa.enabled is true but targetCPUUtilizationPercentage,
targetMemoryUtilizationPercentage, and customMetrics are all unset. Add the
validation near the existing metrics condition in hpa.yaml, using Helm’s fail
pattern like pdb.yaml, while preserving the current rendering for valid metric
configurations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6770e0a2-4ab1-4ce0-9c4c-4e2d8bb9219a
📒 Files selected for processing (42)
.github/workflows/ai-workspace-ui-helm-release.yml.github/workflows/developer-portal-ui-helm-release.yml.github/workflows/platform-api-helm-release.ymlkubernetes/helm/.gitignorekubernetes/helm/ai-workspace-ui-helm-chart/.helmignorekubernetes/helm/ai-workspace-ui-helm-chart/Chart.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tplkubernetes/helm/ai-workspace-ui-helm-chart/templates/certificate.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/configmap.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/issuer.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/pdb.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/service.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values-local.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values.yamlkubernetes/helm/developer-portal-ui-helm-chart/.helmignorekubernetes/helm/developer-portal-ui-helm-chart/Chart.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tplkubernetes/helm/developer-portal-ui-helm-chart/templates/certificate.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/configmap.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/hpa.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/issuer.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/pdb.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/pvc.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/service.yamlkubernetes/helm/developer-portal-ui-helm-chart/values-local.yamlkubernetes/helm/developer-portal-ui-helm-chart/values.yamlkubernetes/helm/platform-api-helm-chart/.helmignorekubernetes/helm/platform-api-helm-chart/Chart.yamlkubernetes/helm/platform-api-helm-chart/templates/_helpers.tplkubernetes/helm/platform-api-helm-chart/templates/certificate.yamlkubernetes/helm/platform-api-helm-chart/templates/configmap.yamlkubernetes/helm/platform-api-helm-chart/templates/deployment.yamlkubernetes/helm/platform-api-helm-chart/templates/hpa.yamlkubernetes/helm/platform-api-helm-chart/templates/issuer.yamlkubernetes/helm/platform-api-helm-chart/templates/pdb.yamlkubernetes/helm/platform-api-helm-chart/templates/pvc.yamlkubernetes/helm/platform-api-helm-chart/templates/service.yamlkubernetes/helm/platform-api-helm-chart/values-local.yamlkubernetes/helm/platform-api-helm-chart/values.yaml
🚧 Files skipped from review as they are similar to previous changes (15)
- kubernetes/helm/ai-workspace-ui-helm-chart/values-local.yaml
- kubernetes/helm/developer-portal-ui-helm-chart/Chart.yaml
- kubernetes/helm/.gitignore
- kubernetes/helm/platform-api-helm-chart/Chart.yaml
- kubernetes/helm/platform-api-helm-chart/.helmignore
- kubernetes/helm/developer-portal-ui-helm-chart/.helmignore
- kubernetes/helm/platform-api-helm-chart/values-local.yaml
- kubernetes/helm/developer-portal-ui-helm-chart/values-local.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/Chart.yaml
- kubernetes/helm/developer-portal-ui-helm-chart/values.yaml
- kubernetes/helm/platform-api-helm-chart/values.yaml
- kubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tpl
- kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl
- kubernetes/helm/ai-workspace-ui-helm-chart/values.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tpl
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml (1)
1-47: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftExtract shared HPA/PDB/Service templates into a common Helm library chart.
The HPA, PDB, and Service templates are duplicated nearly verbatim across the AI Workspace UI and Developer Portal UI charts (and likely the Platform API chart per the stack outline). This is copy-paste duplication with a single root cause: no shared library chart exists for these common resource shapes. Consolidating them would keep behavior in sync as the charts evolve (dev-portal's HPA already diverged with an extra postgres-only guard) and reduce future maintenance cost.
kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml#L1-L47: move this HPA logic into a shared library-chart template parameterized by component name/labels/fullname helper.kubernetes/helm/developer-portal-ui-helm-chart/templates/hpa.yaml#L1-L50: adopt the shared library-chart HPA template, keeping the postgres-only guard as a chart-specific extension point.kubernetes/helm/ai-workspace-ui-helm-chart/templates/pdb.yaml#L1-L29: move this PDB logic into the shared library chart.kubernetes/helm/developer-portal-ui-helm-chart/templates/pdb.yaml#L1-L29: adopt the shared library-chart PDB template.kubernetes/helm/ai-workspace-ui-helm-chart/templates/service.yaml#L1-L49: move this Service logic into the shared library chart.kubernetes/helm/developer-portal-ui-helm-chart/templates/service.yaml#L1-L49: adopt the shared library-chart Service template.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml` around lines 1 - 47, Extract the duplicated HPA, PDB, and Service rendering into a shared Helm library-chart template parameterized by component identity, labels, fullname helpers, and values; update kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml lines 1-47, kubernetes/helm/developer-portal-ui-helm-chart/templates/hpa.yaml lines 1-50, kubernetes/helm/ai-workspace-ui-helm-chart/templates/pdb.yaml lines 1-29, kubernetes/helm/developer-portal-ui-helm-chart/templates/pdb.yaml lines 1-29, kubernetes/helm/ai-workspace-ui-helm-chart/templates/service.yaml lines 1-49, and kubernetes/helm/developer-portal-ui-helm-chart/templates/service.yaml lines 1-49 to consume it. Preserve existing resource behavior and retain the developer portal HPA’s postgres-only guard as a chart-specific extension point.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tpl`:
- Around line 27-35: Prevent component fullname suffixes from being truncated by
updating the apip.platformApi.fullname, apip.aiWorkspace.fullname, and
apip.developerPortal.fullname helpers in
kubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tpl lines 27-35
and kubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tpl lines
27-35; reserve each suffix’s length by truncating the base name to 63 minus that
length before appending it, preferably through a shared apip.componentFullname
helper, while preserving valid Kubernetes name limits and distinct component
names.
In `@kubernetes/helm/platform-api-helm-chart/templates/configmap.yaml`:
- Around line 65-79: Move the file-based user credentials rendered by the
auth.file_based.users range out of the ConfigMap and into a Secret-backed
configuration or volume, including password_hash and scopes. Update the
application’s config consumption so config-platform-api.toml references or loads
those values from the Secret while preserving the existing user authentication
behavior.
In `@kubernetes/helm/platform-api-helm-chart/values.yaml`:
- Around line 126-137: Remove the functional default admin credential from the
fileBased configuration in values.yaml: do not ship the static passwordHash or
an enabled seeded user. Require setup to provide the initial credential, or use
the existing secret-generation and persistence pattern so startup loads a
generated restrictive hash instead of creating the publicly known admin/admin
account; preserve the existing fileBased configuration structure and scopes for
explicitly configured users.
---
Nitpick comments:
In `@kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml`:
- Around line 1-47: Extract the duplicated HPA, PDB, and Service rendering into
a shared Helm library-chart template parameterized by component identity,
labels, fullname helpers, and values; update
kubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yaml lines 1-47,
kubernetes/helm/developer-portal-ui-helm-chart/templates/hpa.yaml lines 1-50,
kubernetes/helm/ai-workspace-ui-helm-chart/templates/pdb.yaml lines 1-29,
kubernetes/helm/developer-portal-ui-helm-chart/templates/pdb.yaml lines 1-29,
kubernetes/helm/ai-workspace-ui-helm-chart/templates/service.yaml lines 1-49,
and kubernetes/helm/developer-portal-ui-helm-chart/templates/service.yaml lines
1-49 to consume it. Preserve existing resource behavior and retain the developer
portal HPA’s postgres-only guard as a chart-specific extension point.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2edb8e78-7965-43fe-a61a-66aef60874b8
📒 Files selected for processing (42)
.github/workflows/ai-workspace-ui-helm-release.yml.github/workflows/developer-portal-ui-helm-release.yml.github/workflows/platform-api-helm-release.ymlkubernetes/helm/.gitignorekubernetes/helm/ai-workspace-ui-helm-chart/.helmignorekubernetes/helm/ai-workspace-ui-helm-chart/Chart.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tplkubernetes/helm/ai-workspace-ui-helm-chart/templates/certificate.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/configmap.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/hpa.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/issuer.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/pdb.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/service.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values-local.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values.yamlkubernetes/helm/developer-portal-ui-helm-chart/.helmignorekubernetes/helm/developer-portal-ui-helm-chart/Chart.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tplkubernetes/helm/developer-portal-ui-helm-chart/templates/certificate.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/configmap.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/hpa.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/issuer.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/pdb.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/pvc.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/service.yamlkubernetes/helm/developer-portal-ui-helm-chart/values-local.yamlkubernetes/helm/developer-portal-ui-helm-chart/values.yamlkubernetes/helm/platform-api-helm-chart/.helmignorekubernetes/helm/platform-api-helm-chart/Chart.yamlkubernetes/helm/platform-api-helm-chart/templates/_helpers.tplkubernetes/helm/platform-api-helm-chart/templates/certificate.yamlkubernetes/helm/platform-api-helm-chart/templates/configmap.yamlkubernetes/helm/platform-api-helm-chart/templates/deployment.yamlkubernetes/helm/platform-api-helm-chart/templates/hpa.yamlkubernetes/helm/platform-api-helm-chart/templates/issuer.yamlkubernetes/helm/platform-api-helm-chart/templates/pdb.yamlkubernetes/helm/platform-api-helm-chart/templates/pvc.yamlkubernetes/helm/platform-api-helm-chart/templates/service.yamlkubernetes/helm/platform-api-helm-chart/values-local.yamlkubernetes/helm/platform-api-helm-chart/values.yaml
🚧 Files skipped from review as they are similar to previous changes (13)
- kubernetes/helm/ai-workspace-ui-helm-chart/values-local.yaml
- kubernetes/helm/developer-portal-ui-helm-chart/.helmignore
- kubernetes/helm/platform-api-helm-chart/Chart.yaml
- kubernetes/helm/.gitignore
- kubernetes/helm/developer-portal-ui-helm-chart/Chart.yaml
- kubernetes/helm/developer-portal-ui-helm-chart/values-local.yaml
- kubernetes/helm/platform-api-helm-chart/values-local.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/Chart.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/.helmignore
- kubernetes/helm/platform-api-helm-chart/.helmignore
- kubernetes/helm/developer-portal-ui-helm-chart/values.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/values.yaml
- kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
kubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yaml (1)
37-40: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winMissing
checksum/configpod annotation — config changes won't trigger a rollout.Unlike the sibling charts (
platform-apideployment Lines 37-42 andai-workspacedeployment Lines 33-38), this template omits the ConfigMap checksum annotation. Whenconfig.tomlchanges onhelm upgrade, the pod template stays identical, so Kubernetes does not roll the Deployment and pods run stale config until manually restarted. Mirror the sibling pattern so config updates propagate automatically.♻️ Proposed fix
- {{- with (merge (dict) (default (dict) $deployment.podAnnotations) (default (dict) .Values.global.commonAnnotations)) }} - annotations: - {{- include "apip.renderStringMap" . | nindent 8 }} - {{- end }} + {{- $podAnnotations := omit (merge (dict) (default (dict) $deployment.podAnnotations) (default (dict) .Values.global.commonAnnotations)) "checksum/config" }} + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- with $podAnnotations }} + {{- include "apip.renderStringMap" . | nindent 8 }} + {{- end }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yaml` around lines 37 - 40, Update the deployment template’s pod annotations block near apip.renderStringMap to add the checksum/config annotation, mirroring the established sibling chart pattern and hashing the rendered config.toml ConfigMap. Preserve the existing merged annotations while ensuring config changes alter the pod template and trigger a rollout.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-workspace-ui-helm-release.yml:
- Around line 29-35: Add the same repository-wide concurrency group with
cancel-in-progress: false to the release-helm-chart job in
.github/workflows/ai-workspace-ui-helm-release.yml lines 29-35,
.github/workflows/developer-portal-ui-helm-release.yml lines 29-35, and
.github/workflows/platform-api-helm-release.yml lines 29-35, so all three Helm
releases serialize without cancelling in-progress runs.
- Around line 40-49: Reject carriage returns and newlines before
semantic-version validation in the Validate input formats step of
.github/workflows/ai-workspace-ui-helm-release.yml (lines 40-49),
.github/workflows/developer-portal-ui-helm-release.yml (lines 40-49), and
.github/workflows/platform-api-helm-release.yml (lines 40-49). Apply the same
scalar-input check to both CHART_VERSION and APP_VERSION before their existing
grep validation and sed usage.
---
Outside diff comments:
In `@kubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yaml`:
- Around line 37-40: Update the deployment template’s pod annotations block near
apip.renderStringMap to add the checksum/config annotation, mirroring the
established sibling chart pattern and hashing the rendered config.toml
ConfigMap. Preserve the existing merged annotations while ensuring config
changes alter the pod template and trigger a rollout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e52b213e-6c76-442f-8dfc-188e563d0afd
📒 Files selected for processing (24)
.github/workflows/ai-workspace-ui-helm-release.yml.github/workflows/developer-portal-ui-helm-release.yml.github/workflows/platform-api-helm-release.ymlkubernetes/helm/.gitignorekubernetes/helm/ai-workspace-ui-helm-chart/Chart.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/_helpers.tplkubernetes/helm/ai-workspace-ui-helm-chart/templates/configmap.yamlkubernetes/helm/ai-workspace-ui-helm-chart/templates/deployment.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values-local.yamlkubernetes/helm/ai-workspace-ui-helm-chart/values.yamlkubernetes/helm/developer-portal-ui-helm-chart/Chart.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tplkubernetes/helm/developer-portal-ui-helm-chart/templates/configmap.yamlkubernetes/helm/developer-portal-ui-helm-chart/templates/deployment.yamlkubernetes/helm/developer-portal-ui-helm-chart/values-local.yamlkubernetes/helm/developer-portal-ui-helm-chart/values.yamlkubernetes/helm/platform-api-helm-chart/Chart.yamlkubernetes/helm/platform-api-helm-chart/templates/_helpers.tplkubernetes/helm/platform-api-helm-chart/templates/certificate.yamlkubernetes/helm/platform-api-helm-chart/templates/configmap.yamlkubernetes/helm/platform-api-helm-chart/templates/deployment.yamlkubernetes/helm/platform-api-helm-chart/templates/issuer.yamlkubernetes/helm/platform-api-helm-chart/values-local.yamlkubernetes/helm/platform-api-helm-chart/values.yaml
🚧 Files skipped from review as they are similar to previous changes (9)
- kubernetes/helm/ai-workspace-ui-helm-chart/Chart.yaml
- kubernetes/helm/platform-api-helm-chart/Chart.yaml
- kubernetes/helm/.gitignore
- kubernetes/helm/platform-api-helm-chart/templates/certificate.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/templates/configmap.yaml
- kubernetes/helm/platform-api-helm-chart/templates/_helpers.tpl
- kubernetes/helm/developer-portal-ui-helm-chart/templates/_helpers.tpl
- kubernetes/helm/developer-portal-ui-helm-chart/values.yaml
- kubernetes/helm/ai-workspace-ui-helm-chart/values.yaml
Contributor
Author
|
@coderabbitai approve |
Contributor
✅ Action performedComments resolved and changes approved. |
Krishanx92
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces Helm packaging and release automation for several platform UI components, along with supporting chart definitions and helper templates. The main changes are the addition of GitHub Actions workflows for Helm chart releases, new chart definitions for the AI Workspace UI, and shared Helm helper templates to standardize deployment configuration.
Related to #2557 and #2560
Helm Release Automation:
ai-workspace-ui(.github/workflows/ai-workspace-ui-helm-release.yml)developer-portal-ui(.github/workflows/developer-portal-ui-helm-release.yml)platform-api(.github/workflows/platform-api-helm-release.yml)Helm Chart Definitions and Structure:
ai-workspace-ui, includingChart.yamland.helmignorefor packaging and build artifact exclusion. [1] [2].gitignorein thekubernetes/helm/directory to ignore generated chart dependencies, lockfiles, and environment-specific secrets.Shared Helm Helper Templates:
_helpers.tplfor theai-workspace-ui-helm-chart, providing reusable Helm template functions for consistent resource naming, label management, image handling, and secret reference validation across components.