pnokerandClaude Code 016befbd9a fix(deploy): close the gaps found in the helm/k8s deployment review ...

Correctness (deployments would fail otherwise):

- configmap/values: add DC3_R2DBC_URL - every center profile defaults
  spring.r2dbc.url to the empty env placeholder and startup fails with
  "URL does not start with the r2dbc scheme" without it. Also add the
  schema contract keys (fingerprint/contract) and align the env set
  with the compose runtime contract: point pipeline keys
  (POINT_BATCH_SIZE/RECEIVE_TIMEOUT/CONSUMERS/PREFETCH/RETRY_*), the
  broker selection (DC3_MQ_TYPE -> dc3.mq.type) and driver lease
  fencing (DC3_DRIVER_LEASE_* -> dc3.driver.lease.*); drop the dead
  POINT_BATCH_SPEED/POINT_BATCH_INTERVAL/DC3_FACADE_GRPC_DEADLINE_MS.
- deploy only the published 28-driver set: dlt645/dnp3/iec61850/kafka/
  knx/lorawan/mbus/redis have no images in the release pipeline and
  would ImagePullBackOff. They default to enabled: false in helm and
  are removed from the kustomization (files stay on disk for when
  they ship); READMEs now state the real coverage.
- helm ingress: wire the cert-manager cluster-issuer annotation - the
  values-production clusterIssuer was inert and the dc3-tls secret
  could never be issued.
- postgres probes resolve $POSTGRES_USER/$POSTGRES_DB from the env
  instead of hardcoding dc3, so overriding credentials no longer
  breaks readiness (helm + k8s).

Safety / ops:

- k8s ingress: TLS off by default (the secret does not exist);
  instructions to enable it.
- web: Always pull policy on latest (k8s) and a pinned 2026.9.22 tag
  in values-production - latest + IfNotPresent serves stale bundles.
- k8s gateway replicas match the HPA minimum (2) to avoid a rescale
  on first apply.
- secret.env: untracked + gitignored (it held literal asterisk
  placeholder passwords); secret.env.example carries the documented
  weak dev defaults and no longer sets the AUTH_HMAC_SECRET value
  that pre/pro rejects. helm dev values use the same dev defaults.
- chart version 0.2.0; READMEs document the native image line and
  the host-device caveat for hardware drivers.

Co-Authored-By: Claude Code <noreply@anthropic.com>

2026-09-23 23:44:53 +08:00

..

helm/dc3

fix(deploy): close the gaps found in the helm/k8s deployment review

2026-09-23 23:44:53 +08:00

k8s

fix(deploy): close the gaps found in the helm/k8s deployment review

2026-09-23 23:44:53 +08:00