feat(event-ledger): add Helm chart for self-hosted stack - #762
Open
shelleyshen-0 wants to merge 12 commits into
Open
feat(event-ledger): add Helm chart for self-hosted stack#762shelleyshen-0 wants to merge 12 commits into
shelleyshen-0 wants to merge 12 commits into
Conversation
Adds deploy/helm/event-ledger, a new Helm chart for deploying event-ledger as an optional add-on in the self-managed stack. - Deploys into the nvcf namespace - ServiceAccount name matches the OpenBao JWT auth role (event-ledger) - App config mounted via ConfigMap at /etc/event-ledger/config.yaml, read via EVENT_LEDGER_CONFIG; sets deprecate-endpoints: true (v3-only), cloudevents disabled, policy provider pointed at api-keys-api - Vault Agent template renders Cassandra credentials from services/event-ledger/kv/data/cassandra/creds and a dummy policy-bearer-token (api-keys-api evaluator is open/unauthenticated) - jwk-set-url points at services/event-ledger/jwt/jwks so inbound SIS/NVCA/NVCF-API JWTs are verified against event-ledger's own engine
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe PR adds an NVCF-owned Helm chart for Event Ledger. It configures deployment, services, autoscaling, Vault/OpenBao credential injection, runtime settings, validation, and deployment notes. It also updates Cassandra and OpenBao migration image tags. ChangesEvent Ledger Helm chart
Migration image updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Helm
participant Kubernetes
participant VaultAgent
participant EventLedger
Helm->>Kubernetes: Render Deployment and ConfigMaps
Kubernetes->>VaultAgent: Start sidecar with Vault annotations
VaultAgent->>VaultAgent: Render Cassandra credentials
VaultAgent->>EventLedger: Provide secrets.json
Kubernetes->>EventLedger: Mount config.yaml and expose ports
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
shelleyshen-0
commented
Aug 11, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/helm/event-ledger/files/secrets.json.tmpl`:
- Around line 2-5: Update the username and password fields in the secrets
template to serialize their interpolated credential values with the Helm toJSON
function, removing the surrounding manual quotes. Leave the policy-bearer-token
value unchanged.
In `@deploy/helm/event-ledger/templates/NOTES.txt`:
- Around line 4-7: Replace the hardcoded event-ledger Service references in the
DNS record and port-forward command with the chart’s rendered Service name,
reusing the existing fullname/service naming template so fullnameOverride values
are honored consistently.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b73471e4-3c79-4c28-a163-af7022fffc3e
📒 Files selected for processing (14)
deploy/helm/cassandra/helm/values.yamldeploy/helm/event-ledger/Chart.yamldeploy/helm/event-ledger/files/secrets.json.tmpldeploy/helm/event-ledger/templates/NOTES.txtdeploy/helm/event-ledger/templates/_helpers.tpldeploy/helm/event-ledger/templates/configmap-app.yamldeploy/helm/event-ledger/templates/configmap-vault-agent-template.yamldeploy/helm/event-ledger/templates/deployment.yamldeploy/helm/event-ledger/templates/hpa.yamldeploy/helm/event-ledger/templates/service.yamldeploy/helm/event-ledger/templates/serviceaccount.yamldeploy/helm/event-ledger/templates/validation.yamldeploy/helm/event-ledger/values.yamldeploy/helm/openbao/helm/values.yaml
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
deploy/helm/event-ledger/templates/deployment.yaml (1)
16-113: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winAdd automated chart coverage or document the exception.
The supplied PR material records manual cluster testing. It does not include automated chart tests or explain why tests are not applicable. Add repository-native rendering coverage for the Deployment, HPA, ServiceAccount, and validation paths. Record the native test command in the PR.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@deploy/helm/event-ledger/templates/deployment.yaml` around lines 16 - 113, Add repository-native Helm chart rendering tests covering the Deployment, HPA, ServiceAccount, and validation paths for the nvcf-event-ledger chart, including assertions for the rendered resources and relevant configuration. If automated coverage cannot be added, document the exception and rationale; otherwise record the command used to run the native tests in the PR.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/helm/event-ledger/templates/deployment.yaml`:
- Around line 30-32: Add a checksum annotation alongside checksum/config-app in
the deployment template, hashing the Vault Agent secrets.json.tmpl content so
changes to that template alter the pod template and trigger a rollout. Use the
chart’s existing template rendering mechanism and preserve the current
annotations.
- Line 24: Conditionally render spec.replicas in the deployment template only
when eventLedger.autoscaling.enabled is false, omitting it entirely when
autoscaling is enabled so the HPA controls the replica count.
---
Outside diff comments:
In `@deploy/helm/event-ledger/templates/deployment.yaml`:
- Around line 16-113: Add repository-native Helm chart rendering tests covering
the Deployment, HPA, ServiceAccount, and validation paths for the
nvcf-event-ledger chart, including assertions for the rendered resources and
relevant configuration. If automated coverage cannot be added, document the
exception and rationale; otherwise record the command used to run the native
tests in the PR.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5a20e895-d9d1-4438-a3fc-37b772b89cc4
📒 Files selected for processing (14)
deploy/helm/cassandra/helm/values.yamldeploy/helm/event-ledger/Chart.yamldeploy/helm/event-ledger/files/secrets.json.tmpldeploy/helm/event-ledger/templates/NOTES.txtdeploy/helm/event-ledger/templates/_helpers.tpldeploy/helm/event-ledger/templates/configmap-app.yamldeploy/helm/event-ledger/templates/configmap-vault-agent-template.yamldeploy/helm/event-ledger/templates/deployment.yamldeploy/helm/event-ledger/templates/hpa.yamldeploy/helm/event-ledger/templates/service.yamldeploy/helm/event-ledger/templates/serviceaccount.yamldeploy/helm/event-ledger/templates/validation.yamldeploy/helm/event-ledger/values.yamldeploy/helm/openbao/helm/values.yaml
🚧 Files skipped from review as they are similar to previous changes (7)
- deploy/helm/event-ledger/files/secrets.json.tmpl
- deploy/helm/cassandra/helm/values.yaml
- deploy/helm/openbao/helm/values.yaml
- deploy/helm/event-ledger/Chart.yaml
- deploy/helm/event-ledger/templates/NOTES.txt
- deploy/helm/event-ledger/values.yaml
- deploy/helm/event-ledger/templates/_helpers.tpl
| labels: | ||
| {{- include "nvcf-event-ledger.labels" . | nindent 4 }} | ||
| spec: | ||
| replicas: {{ .Values.eventLedger.replicaCount }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not set spec.replicas when autoscaling is enabled.
When eventLedger.autoscaling.enabled is true, omit spec.replicas. A Helm upgrade otherwise reapplies eventLedger.replicaCount and resets the replica count selected by the HPA.
Proposed fix
- replicas: {{ .Values.eventLedger.replicaCount }}
+ {{- if not .Values.eventLedger.autoscaling.enabled }}
+ replicas: {{ .Values.eventLedger.replicaCount }}
+ {{- end }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deploy/helm/event-ledger/templates/deployment.yaml` at line 24, Conditionally
render spec.replicas in the deployment template only when
eventLedger.autoscaling.enabled is false, omitting it entirely when autoscaling
is enabled so the HPA controls the replica count.
…to feat/event-ledger-helm-chart
…se toJSON for credentials
shelleyshen-0
requested review from
along-2017,
balajinvda,
borao and
nvjmcnamee
August 12, 2026 00:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #168
Summary
deploy/helm/event-ledgerHelm chart for deploying the event-ledger service in the self-hosted NVCF stackcassandra.cassandra-system.svc.cluster.local)nvcf-cassandra-migrationsto0.16.0andnvcf-openbao-migrationsto0.18.0-test(pending official release)Test plan
2/2 Runningwith Cassandra connected and API server started on:808022_setup_event-ledgerran successfully via0.18.0-testimageevent_ledgerkeyspace created via0.16.0migrations imagenvcf-openbao-migrationstag once official0.18.0image is released🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Updates