feat: deploy solar-ui as part of the solar chart - #743
Conversation
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Only nitpicks e.g. two tiny things beyond the inline suggestions
ui.args.authModeis the only key underargs, whileextraArgssits right next to it as a sibling. Reads a bit odd, you'd maybe expectui.authModedirectly, orextraArgsnested underargs. Pure naming, not important.ui.imagePullSecretsdoc is terser than the siblings (renderer spells out the[{name: my-secret}]shape). Could mirror that one-liner so the value docs stay uniform, up to you 🤷
|
Otherwise LGTM |
good point, i looked into it: both these point would make the ui section more inconsistent with the rest of the file: as for the pullSecrets: renderer is actually the outlier, ui is consistent with apiserver and controller. Renderer looks slightly different because the pod runs in the rt's namespace, so the secret has to exist in multiple namespaces |
What
Builds and publishes the
solar-uiimage in CI, and adds auicomponent to the solar chart so it can actually be deployed.Relates to (odd-internal) # 62
Why
The UI is part of SolAr but had no delivery path: the image was never published, and no chart could run it
Testing
uitarget and ran the image:GET /returns the embeddedindex.html(200),/assets/*.jsthe 584 KB bündlehelm lintclean.helm templaterenders the UI objects with GHCR repo, merged pull secrets and env-injected client secret, and fails as intended whenui.enabled=truewithout an issuer. Default render is identical to beforeNotes for reviewers
get/liston namespaces (the BFF enumerates with its own identity, then filters per user via SelfSubjectRulesReview), plusimpersonateon users/groups only whenui.args.authMode=impersonateui.enabled=false, and the templaterequiredsui.oidc.issuer/ui.oidc.redirectURL. Without an issuer the BFF serves the K8s API as its own ServiceAccount to anyone who reaches the podChecklist