[chore] Update deployment artifacts (docker-compose/, kubernetes/, etc)#4416
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dosubot
Bot
added
the
size:XXL
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughRelocates and rewrites the Helm chart under hosting/kubernetes/helm with compatibility/validation helpers, refactors env.py and consumers to a canonical schema, updates SDKs and web entrypoint, adjusts CI release workflow, refreshes compose/env templates, extensively updates docs, and removes legacy Helm/Terraform assets. ChangesUnified Helm chart and environment model
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes Possibly related issues
Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
|
dosubot
Bot
added
devops
documentation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refreshes self-hosting deployment artifacts by relocating and reworking the Kubernetes Helm chart layout, aligning configuration/env-var surfaces across Docker Compose + Helm, and updating docs/tests to match the new configuration model.
Changes:
- Introduces the new
hosting/kubernetes/helm/chart layout (with OSS/EE example values and ahosting/kubernetes/run.shhelper), and removes the legacyhosting/helm/agenta-oss/chart and old cloud Terraform artifacts. - Updates Docker Compose env examples, compose files, and run scripts to reflect the reshaped canonical env-var model (including deprecation/fallback notes).
- Updates API/SDK code and documentation to use the reshaped env config tree (
env.agenta.*,env.identity.*, etc.), plus adds a v0.100.2 migration guide.
Reviewed changes
Copilot reviewed 100 out of 106 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| sdks/typescript/.gitkeep | Keeps the TypeScript SDK folder tracked in git. |
| sdks/python/oss/tests/pytest/utils/test_hook_v0.py | Updates hook_v0 tests to patch the renamed allow-insecure flag. |
| sdks/python/agenta/sdk/engines/running/handlers.py | Renames allow-insecure flag and adds env var fallback for hook/webhook URL validation. |
| hosting/old/gcp/main.tf | Removes legacy GCP Terraform provider boilerplate. |
| hosting/old/gcp/credentials.json | Removes legacy GCP credentials artifact. |
| hosting/old/gcp/agenta-instance.tf | Removes legacy GCP compute instance Terraform config. |
| hosting/old/aws/main.tf | Removes legacy AWS provider Terraform config. |
| hosting/old/aws/instance-setup.sh | Removes legacy AWS instance bootstrap script. |
| hosting/old/aws/agenta_instance.tf | Removes legacy AWS instance Terraform config. |
| hosting/old/aws/agenta_instance_sg.tf | Removes legacy AWS security group Terraform config. |
| hosting/kubernetes/run.sh | Adds a Helm install/upgrade helper for OSS/EE with optional wait/dry-run/nuke flows. |
| hosting/kubernetes/oss/values.oss.example.yaml | Adds an OSS example values file for the new chart layout. |
| hosting/kubernetes/ee/values.ee.example.yaml | Adds an EE example values file for the new chart layout. |
| hosting/kubernetes/helm/values.yaml | Adds a minimal default values surface intended to mirror compose env defaults. |
| hosting/kubernetes/helm/values.schema.json | Adds a JSON schema for validating the minimal values surface. |
| hosting/kubernetes/helm/templates/api-deployment.yaml | Refactors API deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/api-service.yaml | Switches API service condition/ports to helper includes. |
| hosting/kubernetes/helm/templates/services-deployment.yaml | Refactors services deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/services-service.yaml | Switches services service condition/ports to helper includes. |
| hosting/kubernetes/helm/templates/web-deployment.yaml | Refactors web deployment to use helper-based defaults/safe accessors and new agenta URL values. |
| hosting/kubernetes/helm/templates/web-service.yaml | Switches web service condition/ports to helper includes. |
| hosting/kubernetes/helm/templates/worker-evaluations-deployment.yaml | Refactors worker deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/worker-tracing-deployment.yaml | Refactors worker deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/worker-webhooks-deployment.yaml | Refactors worker deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/worker-events-deployment.yaml | Refactors worker deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/cron-deployment.yaml | Refactors cron deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/alembic-job.yaml | Refactors Alembic job to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/secrets.yaml | Adds chart-managed Secret rendering from the new values model. |
| hosting/kubernetes/helm/templates/serviceaccount.yaml | Refactors ServiceAccount rendering to use safe accessors. |
| hosting/kubernetes/helm/templates/ingress.yaml | Adds a first-class Ingress template using helper-defined settings. |
| hosting/kubernetes/helm/templates/extra-objects.yaml | Adds support for rendering arbitrary extra Kubernetes objects. |
| hosting/kubernetes/helm/templates/tests/test-connection.yaml | Refactors helm test pod to use helper-enabled checks and helper-based ports. |
| hosting/kubernetes/helm/templates/supertokens-deployment.yaml | Refactors SuperTokens deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/supertokens-service.yaml | Switches SuperTokens service condition/ports to helper includes. |
| hosting/kubernetes/helm/templates/redis-volatile-deployment.yaml | Refactors redis-volatile deployment to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/redis-volatile-service.yaml | Switches redis-volatile service condition/ports to helper includes. |
| hosting/kubernetes/helm/templates/redis-durable-statefulset.yaml | Refactors redis-durable statefulset to use helper-based defaults/safe accessors. |
| hosting/kubernetes/helm/templates/redis-durable-service.yaml | Switches redis-durable service condition/ports to helper includes. |
| hosting/kubernetes/helm/templates/postgresql-initdb-configmap.yaml | Keeps initdb ConfigMap gated by helper-based postgresql enabled flag. |
| hosting/kubernetes/helm/templates/postgresql-auth-secret.yaml | Refactors PostgreSQL auth Secret generation to use new postgres.password value. |
| hosting/kubernetes/helm/templates/_validations.tpl | Updates validation logic around Bitnami auth secret wiring guidance. |
| hosting/kubernetes/helm/templates/NOTES.txt | Updates installation notes to match new values layout and helper-based ports/enabled flags. |
| hosting/kubernetes/helm/Chart.yaml | Bumps chart/appVersion and adds chart icon + Bitnami PostgreSQL dependency. |
| hosting/kubernetes/helm/Chart.lock | Adds a lockfile pinning Bitnami PostgreSQL dependency. |
| hosting/helm/agenta-oss/values.yaml | Removes the legacy chart default values file (chart relocation). |
| hosting/helm/agenta-oss/values.schema.json | Removes the legacy chart schema (chart relocation). |
| hosting/helm/agenta-oss/values-oss.example.yaml | Removes the legacy OSS example values file (chart relocation). |
| hosting/helm/agenta-oss/values-ee.example.yaml | Removes the legacy EE example values file (chart relocation). |
| hosting/helm/agenta-oss/templates/secrets.yaml | Removes legacy secrets template (moved to new chart). |
| hosting/helm/agenta-oss/templates/ingress.yaml | Removes legacy ingress template (moved to new chart). |
| hosting/docker-compose/tmp/docker-compose.gh.local.override.yml | Removes deprecated tmp compose override. |
| hosting/docker-compose/tmp/docker-compose.ee.gh.override.yml | Removes deprecated tmp compose override. |
| hosting/docker-compose/run.sh | Adjusts pull defaults and env-file flag parsing (adds --pull and -e/--env alias). |
| hosting/docker-compose/oss/env.oss.gh.example | Reshapes/expands OSS GH env example to the canonical variable model + deprecations. |
| hosting/docker-compose/oss/env.oss.dev.example | Reshapes/expands OSS dev env example to the canonical variable model + deprecations. |
| hosting/docker-compose/oss/docker-compose.otel.yml | Pins the OTEL collector image tag. |
| hosting/docker-compose/oss/docker-compose.gh.yml | Updates image pins (notably Postgres, nginx, SuperTokens). |
| hosting/docker-compose/oss/docker-compose.gh.ssl.yml | Updates image pins (notably Postgres, SuperTokens). |
| hosting/docker-compose/oss/docker-compose.gh.local.yml | Updates image pins (notably Postgres, nginx, SuperTokens). |
| hosting/docker-compose/oss/docker-compose.dev.yml | Updates image pins (notably Postgres, SuperTokens). |
| hosting/docker-compose/ee/README.md | Updates EE compose docs to match new pinned image versions. |
| hosting/docker-compose/ee/env.ee.gh.example | Reshapes/expands EE GH env example to the canonical variable model + deprecations. |
| hosting/docker-compose/ee/env.ee.dev.example | Reshapes/expands EE dev env example to the canonical variable model + deprecations. |
| hosting/docker-compose/ee/docker-compose.gh.yml | Updates image pins (notably Postgres, SuperTokens). |
| hosting/docker-compose/ee/docker-compose.gh.local.yml | Updates image pins (notably Postgres, SuperTokens, stripe-cli). |
| hosting/docker-compose/ee/docker-compose.dev.yml | Updates image pins (notably Postgres, SuperTokens, stripe-cli). |
| docs/docs/self-host/upgrades/v0.100.2-migration.mdx | Adds a dedicated migration guide for the Helm chart relocation + values reshape. |
| docs/docs/self-host/guides/03-deploy-to-kubernetes.mdx | Updates k8s deploy docs to new checkout/layout and install commands (but needs follow-up corrections per comments). |
| docs/docs/self-host/guides/01-deploy-remotely.mdx | Updates clone instructions to use sparse checkout for docker-compose. |
| docs/docs/self-host/guides/04-deploy-on-railway.mdx | Updates clone instructions to use sparse checkout for hosting/railway. |
| docs/docs/self-host/01-quick-start.mdx | Updates clone instructions to use sparse checkout for docker-compose. |
| docs/docs/self-host/03-upgrading.mdx | Updates Helm upgrade path, adds PG 17→18 upgrade guidance, and links to the v0.100.2 one-time migration doc. |
| docs/docs/self-host/04-dynamic-access-controls.mdx | Adds a compose-vs-k8s tip section (but Helm value paths need correction per comments). |
| docs/design/kubernetes-oss-ee-self-hosting/status.md | Updates design doc references for the new helm layout/paths. |
| docs/design/kubernetes-oss-ee-self-hosting/research.md | Updates design doc terminology/paths (kubernetes → helm chart). |
| docs/design/kubernetes-oss-ee-self-hosting/plan.md | Updates design doc example filenames for the new values naming. |
| docs/design/kubernetes-oss-ee-self-hosting/context.md | Updates design doc wording (kubernetes chart → helm chart) and end-state description. |
| api/oss/src/utils/logging.py | Switches logging config reads to env.agenta.logging.*. |
| api/oss/src/utils/caching.py | Switches caching feature flag reads to env.agenta.api.caching.enabled. |
| api/oss/src/core/webhooks/utils.py | Adds canonical env var AGENTA_WEBHOOKS_ALLOW_INSECURE with legacy fallback. |
| api/oss/src/core/auth/turnstile.py | Moves Turnstile config reads under env.cloudflare.turnstile.*. |
| api/oss/src/core/auth/supertokens/config.py | Moves OAuth provider config reads under env.identity.*. |
| api/oss/src/core/auth/service.py | Updates enabled-provider checks to env.identity.*. |
| api/oss/src/core/auth/helper.py | Moves allowed/blocked domain/email config reads under env.agenta.access.*. |
| api/oss/src/core/ai_services/service.py | Moves AI services config reads under env.agenta.ai_services. |
| api/oss/src/apis/fastapi/otlp/router.py | Moves OTLP max batch size under env.agenta.otlp.max_batch_bytes. |
| api/oss/databases/postgres/migrations/core/utils.py | Moves auto-migration flag under env.alembic.auto_migrations. |
| api/oss/databases/postgres/migrations/tracing/utils.py | Moves auto-migration flag under env.alembic.auto_migrations. |
| api/ee/tests/pytest/unit/test_controls_env_override.py | Updates env paths in subprocess snippets to the reshaped env model. |
| api/ee/tests/pytest/unit/test_compute_meter_id.py | Updates meter namespace derivation documentation/test to the new fixed UUID derivation. |
| api/ee/src/services/commoners.py | Updates org creation allowlist env path to env.agenta.access.allowed_owner_emails and updates docstring. |
| api/ee/src/core/subscriptions/types.py | Updates default plan lookup to env.agenta.access.default_plan. |
| api/ee/src/core/subscriptions/settings.py | Updates billing env access to env.agenta.billing.* and default plan env path. |
| api/ee/src/core/meters/types.py | Changes meters namespace UUID derivation to be independent of env and removes env import. |
| api/ee/src/core/entitlements/controls.py | Updates access control env reads to env.agenta.access.*. |
| api/ee/databases/postgres/migrations/core/utils.py | Moves auto-migration flag under env.alembic.auto_migrations. |
| api/ee/databases/postgres/migrations/tracing/utils.py | Moves auto-migration flag under env.alembic.auto_migrations. |
| .gitignore | Ignores local k8s .values.*.yaml overlays while keeping values.*.example.yaml tracked. |
| .github/workflows/09-helm-publish.yml | Removes legacy helm publish workflow targeting the old chart path. |
| .github/workflows/01-create-release-branch.yml | Adds automated version bumping for the new hosting/kubernetes/helm/Chart.yaml. |
Comments suppressed due to low confidence (2)
hosting/kubernetes/helm/templates/postgresql-initdb-configmap.yaml:5
- This ConfigMap creates an
init-db.sql, but the chart doesn’t set the Bitnami subchart value that makes Postgres actually execute it (e.g.,postgresql.primary.initdb.scriptsConfigMap: <release>-postgresql-initdb). Without wiring, the bundled DB won’t auto-create the core/tracing/supertokens databases this script defines.
hosting/kubernetes/helm/templates/postgresql-auth-secret.yaml:5 - This Secret is intended to provide
POSTGRES_PASSWORD, but the chart doesn’t define defaults that wire the Bitnami PostgreSQL subchart to read its password fromglobal.postgresql.auth.existingSecret/secretKeys.*(so the subchart will generate/use a different password). Add/restore those default values so bundled PostgreSQL and the application agree on the password key/name.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Railway Preview Environment
Updated at 2026-05-26T22:08:06.687Z |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 102 out of 108 changed files in this pull request and generated 6 comments.
Comments suppressed due to low confidence (1)
hosting/kubernetes/helm/Chart.yaml:6
- Chart metadata is still set to
version: 0.100.1/appVersion: v0.100.1, but this PR and its migration docs are scoped to the v0.100.2 deployment-artifacts refresh. If this PR is intended to ship with v0.100.2, bump Chart.yaml accordingly sohelmpackaging,Chart.AppVersion, and the published chart version stay consistent with the release.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 113 out of 119 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
hosting/kubernetes/helm/templates/web-deployment.yaml:54
- AGENTA_WEB_URL / AGENTA_SERVICES_URL / AGENTA_API_URL are populated from
$agenta.{webUrl,servicesUrl,apiUrl}directly, but the chart’s documented/validated behavior is to derive these fromingress.hostwhen ingress is enabled (seeagenta.{web,api,services}UrlEffective+validatePublicUrls). With ingress enabled and these values unset (the expected default), this Deployment will inject empty URLs into the web container even though the install passes validation. Use the effective URL helpers (or reuse the same helper used byagenta.commonEnv) so the web pod always receives the derived URLs.
`default true $sa.create` treats an explicit false as unset and still creates the ServiceAccount. Switch both serviceaccount.yaml and the agenta.serviceAccountName helper to a hasKey check so the values default to true only when the key is omitted — keeping the template and helper in agreement so pods don't reference a SA name the chart never created. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Member
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 20
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e3a7f5a1-15b8-42af-a651-09e487778aa2
⛔ Files ignored due to path filters (1)
hosting/kubernetes/helm/Chart.lockis excluded by!**/*.lock
📒 Files selected for processing (118)
.github/workflows/01-create-release-branch.yml.github/workflows/09-helm-publish.yml.gitignoreapi/ee/databases/postgres/migrations/core/utils.pyapi/ee/databases/postgres/migrations/tracing/utils.pyapi/ee/src/core/entitlements/controls.pyapi/ee/src/core/meters/types.pyapi/ee/src/core/subscriptions/settings.pyapi/ee/src/core/subscriptions/types.pyapi/ee/src/services/commoners.pyapi/ee/tests/pytest/unit/test_compute_meter_id.pyapi/ee/tests/pytest/unit/test_controls_env_override.pyapi/oss/databases/postgres/migrations/core/utils.pyapi/oss/databases/postgres/migrations/tracing/utils.pyapi/oss/src/apis/fastapi/otlp/router.pyapi/oss/src/core/ai_services/service.pyapi/oss/src/core/auth/helper.pyapi/oss/src/core/auth/service.pyapi/oss/src/core/auth/supertokens/config.pyapi/oss/src/core/auth/turnstile.pyapi/oss/src/core/webhooks/utils.pyapi/oss/src/utils/caching.pyapi/oss/src/utils/env.pyapi/oss/src/utils/logging.pyapi/oss/tests/pytest/acceptance/test_revision_commit_extra_forbid.pydocs/design/kubernetes-oss-ee-self-hosting/context.mddocs/design/kubernetes-oss-ee-self-hosting/plan.mddocs/design/kubernetes-oss-ee-self-hosting/pr-description.mddocs/design/kubernetes-oss-ee-self-hosting/qa-plan.mddocs/design/kubernetes-oss-ee-self-hosting/research.mddocs/design/kubernetes-oss-ee-self-hosting/status.mddocs/docs/self-host/01-quick-start.mdxdocs/docs/self-host/02-configuration.mdxdocs/docs/self-host/03-upgrading.mdxdocs/docs/self-host/04-dynamic-access-controls.mdxdocs/docs/self-host/guides/01-deploy-remotely.mdxdocs/docs/self-host/guides/03-deploy-to-kubernetes.mdxdocs/docs/self-host/guides/04-deploy-on-railway.mdxdocs/docs/self-host/upgrades/v0.100.2-migration.mdxhosting/docker-compose/ee/README.mdhosting/docker-compose/ee/docker-compose.dev.ymlhosting/docker-compose/ee/docker-compose.gh.local.ymlhosting/docker-compose/ee/docker-compose.gh.ymlhosting/docker-compose/ee/env.ee.dev.examplehosting/docker-compose/ee/env.ee.gh.examplehosting/docker-compose/oss/docker-compose.dev.ymlhosting/docker-compose/oss/docker-compose.gh.local.ymlhosting/docker-compose/oss/docker-compose.gh.ssl.ymlhosting/docker-compose/oss/docker-compose.gh.ymlhosting/docker-compose/oss/docker-compose.otel.ymlhosting/docker-compose/oss/env.oss.dev.examplehosting/docker-compose/oss/env.oss.gh.examplehosting/docker-compose/run.shhosting/docker-compose/tmp/docker-compose.ee.gh.override.ymlhosting/docker-compose/tmp/docker-compose.gh.local.override.ymlhosting/helm/agenta-oss/Chart.yamlhosting/helm/agenta-oss/templates/NOTES.txthosting/helm/agenta-oss/templates/_helpers.tplhosting/helm/agenta-oss/templates/_validations.tplhosting/helm/agenta-oss/templates/ingress.yamlhosting/helm/agenta-oss/templates/secrets.yamlhosting/helm/agenta-oss/templates/serviceaccount.yamlhosting/helm/agenta-oss/values-ee.example.yamlhosting/helm/agenta-oss/values-oss.example.yamlhosting/helm/agenta-oss/values.schema.jsonhosting/helm/agenta-oss/values.yamlhosting/kubernetes/ee/values.ee.example.yamlhosting/kubernetes/helm/Chart.yamlhosting/kubernetes/helm/charts/postgresql-18.5.1.tgzhosting/kubernetes/helm/templates/NOTES.txthosting/kubernetes/helm/templates/_compatibility.tplhosting/kubernetes/helm/templates/_helpers.tplhosting/kubernetes/helm/templates/_validations.tplhosting/kubernetes/helm/templates/alembic-job.yamlhosting/kubernetes/helm/templates/api-deployment.yamlhosting/kubernetes/helm/templates/api-service.yamlhosting/kubernetes/helm/templates/cron-deployment.yamlhosting/kubernetes/helm/templates/extra-objects.yamlhosting/kubernetes/helm/templates/ingress.yamlhosting/kubernetes/helm/templates/postgresql-auth-secret.yamlhosting/kubernetes/helm/templates/postgresql-initdb-configmap.yamlhosting/kubernetes/helm/templates/redis-durable-service.yamlhosting/kubernetes/helm/templates/redis-durable-statefulset.yamlhosting/kubernetes/helm/templates/redis-volatile-deployment.yamlhosting/kubernetes/helm/templates/redis-volatile-service.yamlhosting/kubernetes/helm/templates/secrets.yamlhosting/kubernetes/helm/templates/serviceaccount.yamlhosting/kubernetes/helm/templates/services-deployment.yamlhosting/kubernetes/helm/templates/services-service.yamlhosting/kubernetes/helm/templates/supertokens-deployment.yamlhosting/kubernetes/helm/templates/supertokens-service.yamlhosting/kubernetes/helm/templates/tests/test-connection.yamlhosting/kubernetes/helm/templates/web-deployment.yamlhosting/kubernetes/helm/templates/web-service.yamlhosting/kubernetes/helm/templates/worker-evaluations-deployment.yamlhosting/kubernetes/helm/templates/worker-events-deployment.yamlhosting/kubernetes/helm/templates/worker-tracing-deployment.yamlhosting/kubernetes/helm/templates/worker-webhooks-deployment.yamlhosting/kubernetes/helm/values.schema.jsonhosting/kubernetes/helm/values.yamlhosting/kubernetes/oss/values.oss.example.yamlhosting/kubernetes/run.shhosting/old/aws/agenta_instance.tfhosting/old/aws/agenta_instance_sg.tfhosting/old/aws/instance-setup.shhosting/old/aws/main.tfhosting/old/gcp/agenta-instance.tfhosting/old/gcp/credentials.jsonhosting/old/gcp/main.tfsdks/python/agenta/sdk/engines/running/handlers.pysdks/python/agenta/sdk/engines/running/runners/daytona.pysdks/python/agenta/sdk/engines/running/runners/registry.pysdks/python/agenta/sdk/engines/running/sandbox.pysdks/python/agenta/sdk/middlewares/routing/auth.pysdks/python/agenta/sdk/middlewares/running/vault.pysdks/python/oss/tests/pytest/utils/test_hook_v0.pysdks/typescript/.gitkeepweb/entrypoint.sh
💤 Files with no reviewable changes (20)
- hosting/helm/agenta-oss/Chart.yaml
- hosting/docker-compose/tmp/docker-compose.ee.gh.override.yml
- hosting/helm/agenta-oss/templates/NOTES.txt
- hosting/old/aws/instance-setup.sh
- hosting/helm/agenta-oss/templates/_validations.tpl
- hosting/helm/agenta-oss/templates/secrets.yaml
- hosting/helm/agenta-oss/values-oss.example.yaml
- hosting/old/gcp/main.tf
- hosting/helm/agenta-oss/templates/_helpers.tpl
- hosting/helm/agenta-oss/values.yaml
- hosting/helm/agenta-oss/values.schema.json
- hosting/old/aws/agenta_instance_sg.tf
- hosting/helm/agenta-oss/values-ee.example.yaml
- hosting/old/aws/agenta_instance.tf
- hosting/old/aws/main.tf
- .github/workflows/09-helm-publish.yml
- hosting/docker-compose/tmp/docker-compose.gh.local.override.yml
- hosting/helm/agenta-oss/templates/ingress.yaml
- hosting/old/gcp/agenta-instance.tf
- hosting/helm/agenta-oss/templates/serviceaccount.yaml
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 113 out of 119 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
hosting/kubernetes/helm/templates/web-deployment.yaml:54
- web-deployment.yaml sets AGENTA_{WEB,API,SERVICES}_URL from raw
agenta.{webUrl,apiUrl,servicesUrl}values (defaulting to empty). This breaks the intended behavior where these URLs can be derived fromingress.hostwheningress.enabled=true(andagenta.validatePublicUrlsalready validates the effective URLs). Use the existing helpers (agenta.webUrlEffective,agenta.apiUrlEffective,agenta.servicesUrlEffective) here so the web pod gets non-empty URLs whenever the chart’s effective URL logic is satisfied.
- helm: agenta.initContainers helper + per-deployment guard so an
all-external config doesn't render an empty initContainers: list
(api, services, workers x4).
- helm: ingress guards on api/services/web enablement so disabling
all three doesn't emit an Ingress with an empty paths: list.
- helm: redis-durable storageClass uses hasKey so an explicit "" is
honored (canonical "use cluster default StorageClass").
- supertokens config: replace `assert env.identity.*.X is not None`
with explicit raise so checks survive `python -O`.
- run.sh: only append --wait/--timeout when not in --dry-run, since
those flags aren't valid for `helm template`.
- sdk handlers: recognize the canonical AGENTA_WEBHOOKS_ALLOW_INSECURE
alongside the legacy AGENTA_WEBHOOK_ALLOW_INSECURE.
- docker-compose: drop bogus :0 tag from otel-collector image
(404 on Docker Hub); revert to unpinned.
- docker-compose: dev env examples default to agenta-{ee,oss}-dev
COMPOSE_PROJECT_NAME so the dev stack doesn't share the gh
namespace and collide on networks/volumes.
- docs: deploy-to-kubernetes troubleshooting bullet says "Public URLs
incorrect" (the keys listed are webUrl/apiUrl/servicesUrl, not DB).
- docs: v0.100.2 migration Path A says `helm upgrade` will print the
compat NOTE (Path A is an upgrade workflow).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v0.100.2 env reshape moved blocked/allowed domain config from env.agenta.* to env.agenta.access.*, but the SimpleNamespace monkeypatch in test_get_blocked_domains_* was never updated. The tests crashed with AttributeError on access in CI. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…-AI/agenta into chore/update-deployment-artifacts
Base advanced from release/v0.100.2 to release/v0.100.3, but the chart, migration guide, and surrounding documentation still referenced .2. Updated: - Chart.yaml: version 0.100.2 → 0.100.3, appVersion v0.100.2 → v0.100.3 - Renamed v0.100.2-migration.mdx → v0.100.3-migration.mdx - NOTES.txt, _compatibility.tpl, _helpers.tpl, secrets.yaml, hosting/kubernetes/run.sh, registry.py — comment/string updates - 03-upgrading.mdx callout retargeted - pr-description.md + qa-plan.md retargeted - v0.102 (compat-layer removal target) → v0.103 All "pre-v0.100.x → v0.100.x" boundary labels in docs/comments also shifted to the new release. Chart lints and renders 30 resources clean under the OSS example values. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- hosting/kubernetes/run.sh: require kubectl only when --nuke is set; plain helm upgrade --install (and --dry-run) no longer need it. - docs/03-upgrading.mdx: add -T to docker compose exec pg_dumpall so the logical backup is a clean SQL stream without TTY control chars. - docs/blog: anchor link rename #redis-caching -> #redis. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 115 out of 124 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
hosting/kubernetes/helm/templates/tests/test-connection.yaml:19
busybox:1is a floating tag, sohelm testresults can change over time (and might break if the tag’s contents change). Consider pinning to a specific BusyBox minor/patch tag (or an image digest) for reproducible tests (and apply consistently to the other BusyBox usages in this chart, e.g. wait-for init containers).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deployment artifacts refresh for v0.100.3 (helm + compose + env)
Why this PR exists
The deployment artifacts (Helm chart, docker-compose, env files) had drifted from the actual application config surface defined in
api/oss/src/utils/env.py. The drift made every self-host upgrade harder than it should be: variable names didn't match between the three surfaces, several knobs existed in env.py but not in the chart, the chart used Kubernetes-flavored groupings (secrets.*,accessControl.*,email.*) that an Agenta operator had no prior context for, and the example values files contained stale and partially-empty placeholders. This PR resolves that drift in one pass, lands a self-contained chart athosting/kubernetes/helm/, and ships a written migration path from pre-v0.100.3 deployments.Non-breaking by construction
Every renamed environment variable retains its legacy name as a fallback in
api/oss/src/utils/env.py. The Pydantic loader reads the new name first, falls back to the old, so existing deployments keep working without setting anything new. Helmvalues.yamlkey reshape is a breaking change for users upgrading the chart (no way to alias YAML paths), and that's exactly what the migration guide atdocs/docs/self-host/upgrades/v0.100.3-migration.mdxwalks through, with a step-by-step rewrite procedure that's been QA'd end-to-end on a live cluster (seedocs/design/kubernetes-oss-ee-self-hosting/qa-plan.md). The QA exercised: install from v0.100.1 → snapshot values →git checkoutto this branch → translate values →helm upgrade→ verify pods, PVCs, alembic, ingress, and the newdefaultPlanOverlayknob all survived; no data loss, same auth keys, same crypt key, same Postgres password.1. Canonical config mapping (
hosting/kubernetes/CONFIG_MAPPING.md)The whole refactor hangs off a single source of truth: a three-column table mapping every environment variable to its
env.pyattribute path and itsvalues.yamlpath, with legacy names struck through where they were renamed. Naming rule:AGENTA_<GROUP>_<FIELD>↔env.<group>.<field>↔<group>.<field>(helm). Exceptions foridentity.*(noAGENTA_prefix because they're OIDC provider names likeGOOGLE_*) andllm.*(same reason). This file is referenced from every doc that touches deployment config and is intended to stay as the canonical mapping going forward.2.
api/oss/src/utils/env.pyreshape (with legacy aliases)env.pyis regrouped to matchCONFIG_MAPPING.md: top-level sectionsagenta.{access,aiServices,api,billing,extras,logging,otlp,services,webhooks}, plusalembic,cloudflare.turnstile,identity.<provider>,llm,postgres,redis,sendgrid,stripe,supertokens,newrelic, etc. Every renamed field readsos.getenv("NEW") or os.getenv("LEGACY")so old env vars still resolve. Major renames (full list inCONFIG_MAPPING.mddeprecation table):AGENTA_ALLOWED_DOMAINS→AGENTA_ACCESS_ALLOWED_DOMAINS,AGENTA_DEMOS→AGENTA_EXTRAS_DEMOS,AGENTA_LOG_*→AGENTA_LOGGING_*,AGENTA_CACHE_ENABLED→AGENTA_API_CACHING_ENABLED,AGENTA_WEBHOOK_ALLOW_INSECURE→AGENTA_WEBHOOKS_ALLOW_INSECURE(API side) /AGENTA_SERVICES_HOOK_ALLOW_INSECURE(SDK side),SUPERTOKENS_CONNECTION_URI→SUPERTOKENS_URI_CORE,SUPERTOKENS_EMAIL_DISABLED→AGENTA_ACCESS_EMAIL_DISABLED,POSTHOG_HOST→POSTHOG_API_URL,STRIPE_TARGET→STRIPE_WEBHOOK_TARGET,NEW_RELIC_LICENSE_KEY→NEWRELIC_LICENSE_KEY,ACTIVE_DIRECTORY_OAUTH_*→AZURE_AD_OAUTH_*. Removed (was unused):AGENTA_RUNTIME_PREFIX. All API/EE/SDK consumers updated to the new attribute paths.3. Helm chart relocation:
hosting/helm/agenta-oss/→hosting/kubernetes/helm/The chart is now self-contained at
hosting/kubernetes/helm/(publishable as-is to a Helm repo), with edition-specific example values living outside the chart athosting/kubernetes/{oss,ee}/values.{oss,ee}.example.yaml. Chart name isagenta(the previousagenta-osswas misleading since the same chart deploys EE); rendered resource names follow the standard<release>-agenta-*pattern. The chart's ownvalues.yamlmirrors only the docker-compose env surface (the irreducible set of values an operator must provide); everything else — image repositories, ports, replicas, resource requests, ingress wiring, postgresql/redis subchart knobs — is supplied by templates and helpers viadefaultfallbacks. This makes the chart lint cleanly standalone and means the example files don't have to repeat platform plumbing.4. Helm chart key reshape (
values.yamlkeys regrouped by domain)Where pre-v0.100.3 used Kubernetes-flavored groupings (
global.*for license + URLs,secrets.*for everything secret-shaped,accessControl.*,email.*,integrations.*,observability.*,captcha.*), v0.100.3 groups by domain:agenta.{license,webUrl,apiUrl,servicesUrl,authKey,cryptKey},agenta.access.*,identity.<provider>.*,llm.*,postgres.*,sendgrid.*,composio.*,newrelic.*,cloudflare.turnstile.*. An operator who knows the env vars now recognizes the yaml on sight (the three surfaces encode the same nesting). The migration guide has the full reshape table; the canonical mapping is inCONFIG_MAPPING.md. A compat layer in_compat.tplaccepts the pre-v0.100.3 shape (legacyglobal.*,secrets.*,accessControl.*,email.*,integrations.*,observability.*,captcha.*) and folds it into the canonical positions at render time — operators can upgrade withhelm upgrade -f pre-v0.100.3-values.yamland only rewrite their values file when convenient. The fold useshasKey(not truthyif), so an explicitfalse/""/0from a legacy values file is preserved instead of being silently dropped to the canonical default — important for booleans likeaccessControl.emailDisabled: false. The compat layer is transitional and is planned for removal one minor release after v0.100.3;NOTES.txtflags every install where legacy keys are detected so it stays visible.5. Helm templates:
_helpers.tplrewrite + per-template conventionsTemplates were rewritten to use
{{- $values := include "agenta.values" . | fromYaml -}}at the top, plus same-named per-group locals ($api,$web,$ingress,$newrelic, etc.) rooted in$values. This makes every template nil-safe and routes every read through the compat layer, so legacy keys translate uniformly whether they're consumed in helpers or directly in templates.agenta.valuesis the single permanent helper in_helpers.tpl; it delegates toagenta.deprecatedin_compat.tpl. Removing the compat layer in the future means deleting one file and replacing the body ofagenta.valueswith a single line — no consumer changes._helpers.tplconsolidates env-var rendering: a singlecommonEnvhelper inlines what used to be split acrosscommonEnv+backendOptionalEnv.commonEnvcovers every value documented in the example files — includingagenta.access.emailDisabled(→AGENTA_ACCESS_EMAIL_DISABLED),cloudflare.turnstile.allowedHostnames(→CLOUDFLARE_TURNSTILE_ALLOWED_HOSTNAMES), and the SuperTokens password-policy knobs (supertokens.{application,tenant,passwordPolicy,passwordMinLength,passwordMaxLength,passwordRegex}) — so documented values never become dead config. Identity-provider env vars are similarly auto-derived fromidentity.<provider>.*and LLM keys fromllm.<provider>so an operator settingidentity.google.clientIdorllm.openaigets the correspondingGOOGLE_OAUTH_CLIENT_ID/OPENAI_API_KEYenv vars on api/web/services/workers without also writing into a rawsecrets.*map. Theredis-durable-statefulset.yamltemplate defaults persistence totruewhenredisDurable.persistence.enabledis unset, and honors an explicitfalse(QA caught the missing default — without it, the upgrade fails becausevolumeClaimTemplatesis an immutable StatefulSet field, and v0.100.1 had persistence enabled by default; the explicit-falsepath useshasKeyso it can't be silently flipped back totrue). The chart'svalues.yamlpinspostgresql.primary.persistence.size: "10Gi"andpostgresql.image.tag: "18"so the Bitnami subchart's defaults never float (the size pin was caught by QA; the image-tag pin keeps the chart aligned with thepostgres:18pin in Docker Compose — Postgres data directories are tied to the major version that created them). Ingress default istraefik(backends hardcodeSCRIPT_NAME=/api|/servicesso the ingress class must strip prefixes; the example values ship the matching Traefik StripPrefix middleware underextraObjects). The chart-managedSecrettemplate renders each conditional identity-provider key on its own line so emitted YAML keeps the required two-space indent understringData:even when only some provider fields are set._validations.tplrejects the misconfiguration wheresecrets.existingSecretis set with bundled Postgres enabled butglobal.postgresql.auth.existingSecretis left at the chart default (detected by looking for the unrendered{{...}}tpl expression — Helm doesn't tpl-render values.yaml, the Bitnami subchart does at install time).values.schema.jsonenumerates every documented values key with leaf-level types and env-var pointers, so misspellings likeagenta.bogusKeyfail athelm install; Bitnami subchart and per-component overrides stay open.6. Example values files (
hosting/kubernetes/{oss,ee}/values.{oss,ee}.example.yaml)Two example files, one per edition. License + endpoints + secrets uncommented (essentials operators must edit); everything else commented with sample values, no empty placeholders. Section order: License → Images → Endpoints → Secrets → rest alphabetical. The Traefik StripPrefix middleware setup discovered during QA is shown (commented out) under
ingress.annotations+extraObjectsso future readers find the pattern. Postgres PVC size and redis-durable persistence are also shown (commented) under their respective sections.7. Docker-compose env files + compose files
hosting/docker-compose/{oss,ee}/env.{oss,ee}.{dev,gh}.exampleregenerated with the same canonical mapping: ordering License → Images (commented) → Endpoints → Secrets → rest alphabetical. Variable names matchenv.pyandvalues.yamlexactly; defaults shown match what the code actually applies when the variable is unset (in particularAGENTA_SERVICES_HOOK_ALLOW_INSECUREandAGENTA_WEBHOOKS_ALLOW_INSECUREshowtrue, matching the code default for backwards-compatibility with pre-v0.100.3 deployments — operators tightening these flip them tofalseexplicitly). Legacy aliases are no longer carried inline in the env files; the full deprecation table lives inCONFIG_MAPPING.mdand the migration guide. Compose files themselves bumped/pinned to current images (notablypostgres:18, matching the new chart pin).8. Run scripts
hosting/docker-compose/run.shand a newhosting/kubernetes/run.shshare a near-identical CLI surface (--oss/--ee,--nuke,--wait,--env/--values, etc.) so an operator can switch between compose and helm without relearning flags. Helm's run.sh wraps the commonhelm upgrade --installinvocation against the new chart paths. On re-install, the script inspects the existing release'sagenta.licenseand refuses an OSS↔EE flip; without that check,--reuse-values+--set agenta.license=$LICENSEwould silently swap the edition.9. Migration guide (
docs/docs/self-host/upgrades/v0.100.3-migration.mdx)New page. Three reshape tables (chart folder relocation,
values.yamlkey reshape, env-var renames with legacy aliases), seven-step migration procedure with concrete commands includinghelm get valuessnapshot and akubectl-only fallback for unwrapping the release Secret when helm isn't available. Includes a worked example for translatingaccessControl.plans→agenta.access.plans, OAuthsecrets.oauth.*→identity.<provider>.*, andllmProviders.*→llm.*. Calls out the newagenta.access.defaultPlanOverlayv0.100.3 feature with a usage snippet (live-verified during QA: round-trips YAML → ConfigMap → pod env intact). The "Verify" step uses the actual resource names the chart emits (job/<release>-agenta-alembic, ingress-based curl) and warns about the expected Alembic Job retry pattern during the Postgres StatefulSet roll.10. Install + upgrade guides (
docs/docs/self-host/guides/03-deploy-to-kubernetes.mdx,docs/docs/self-host/03-upgrading.mdx)Install guide updated to v0.100.3 values paths (
agenta.authKey,postgres.password,agenta.webUrl,sendgrid.{apiKey,fromAddress}, etc.) and gains an explicit ingress prerequisite plus a local-testing Traefik recipe (Traefik v3 +/etc/hosts+ port-forward) — without it, new operators following the Quick Start with EE values discover the hard way that a single port-forward can't satisfy path-based routing.openssl randsnippet added for the EE path (the OSS path had one, EE didn't). The existing-Secret path documents the required pairing: whensecrets.existingSecretis set with bundled Postgres enabled,global.postgresql.auth.existingSecretmust point at the same Secret (the chart now fails the install with a clear error otherwise).NOTES.txtlists every optional key the chart consumes from a pre-created Secret (LLM providers, identity providers, sendgrid, composio, daytona, newrelic, …) so operators don't have to read templates to know what to put in it. Upgrade page links to the v0.100.3 migration callout.11. Configuration reference (
docs/docs/self-host/02-configuration.mdx)Rewritten as per-section three-column tables (env var | env.py path | values.yaml path) matching
CONFIG_MAPPING.md. Deprecated variables collected in a single table at the bottom with their canonical replacements. Replaces the previous mix of prose + inconsistent partial tables.12. CI/release workflows
.github/workflows/01-create-release-branch.ymlalso bumps the Helm chart version when cutting a release branch (Helm chartversionandappVersionnow stay in lockstep with API/SDK/web versions). The standalone application-side.github/workflows/09-helm-publish.ymlis removed — Helm publishing moves to the platform-side41-release-to-public.ymlchain so it runs off the same release branch as PyPI and GHCR publishes. (Platform-side workflow change lives in the platform repo.)13. Cleanups (dead code, generated artifacts)
hosting/old/{aws,gcp}/Terraform left over from an abandoned cloud-hosting attempt is removed (verified unreferenced).hosting/docker-compose/tmp/*.override.ymlleft over from local debugging is removed.sdks/typescript/.gitkeepremoved (the directory has real content now). The oldhosting/helm/agenta-oss/chart directory is removed; the new chart lives athosting/kubernetes/helm/.14. SDK runtime hooks (
sdks/python/agenta/sdk/engines/running/handlers.py)The SDK reads
AGENTA_SERVICES_HOOK_ALLOW_INSECUREfirst, falling back toAGENTA_WEBHOOK_ALLOW_INSECURE. The rename clarifies that this flag governs SDK-side workflow hooks (which talk to user code), not API-side webhooks (which the API delivers outward). Both names work; the legacy form is documented as deprecated. The middleware toggles (AGENTA_SERVICES_MIDDLEWARE_AUTH_ENABLED/_CACHING_ENABLED) similarly fall back to their pre-v0.100.3 names — which were singularAGENTA_SERVICE_MIDDLEWARE_{AUTH,CACHE}_ENABLED(theSwas added in this PR's canonical shape, and the migration table records the singular form as the legacy alias).15. Misc API touch-ups for the env reshape
api/ee/src/core/meters/types.pyinlinesAGENTA_METERS_NAMESPACE_UUID(previouslyenv.agenta.uuid_namespace, a static computed value — moving it to a module constant removes a config knob that operators couldn't meaningfully set). EE controls test (test_controls_env_override.py) updated for the newAGENTA_ACCESS_*env-var names. Supertokens config readsSUPERTOKENS_URI_COREwithSUPERTOKENS_CONNECTION_URIfallback, and the chart emits the canonical name across every container (api, services, workers, web) — the web container'sentrypoint.shback-fills the legacySUPERTOKENS_CONNECTION_URIfrom the canonical name so older web images still pick it up without the chart needing to ship both. Auth/turnstile/webhooks/caching/logging modules updated to read from the newenv.agenta.*attribute paths via the sharedenvobject (perAGENTS.md's no-raw-os.getenvrule).QA evidence
docs/design/kubernetes-oss-ee-self-hosting/qa-plan.mdcaptures the live cluster QA: install pre-v0.100.3 (v0.100.1EE tag) → create data → snapshot values → checkout this branch → translate values →helm upgrade→ verify. Caught (and fixed in this PR) two chart regressions: missing postgres PVC size pin and missing redis-durable persistence default. Plus six doc-gaps in the migration guide and install guide (wrong Job/Service names, missing ingress prerequisite, stale values paths) — all listed at the bottom of qa-plan.md with FIXED/NOT-FIXED status and file paths.Risk assessment
_compat.tplaccepts pre-v0.100.3 keys (global.*,secrets.*,accessControl.*,email.*,integrations.*,observability.*,captcha.*) and folds them into the canonical v0.100.3 positions at render time, so existing values files keep working through the upgrade. The migration guide documents both paths: reuse the legacy file as-is (recommended fast path), or rewrite into the canonical shape (slower but produces a long-term-clean file). Compat layer is transitional and planned for removal one minor release after v0.100.3.agenta-oss→agenta). Rendered names follow Helm's standardfullnamecollapse: when the release name isagenta(the defaulthelm install agenta …), resources render asagenta-api,agenta-alembic, etc.; otherwise they render as<release>-agenta-api. Pre-v0.100.3 installs used the old chart name and therefore had<release>-agenta-oss-*Services/Jobs — Service DNS hostnames and Job names change on upgrade. PVCs follow the subchart and StatefulSet names (<release>-postgresql-0,data-<release>-agenta-redis-durable-0), so data survives, but any external references (Job-name greps in operator scripts, in-cluster DNS pointing at<release>-agenta-oss-api) need a one-time rename. The migration guide covers this.helm upgradefrom v0.100.1 to v0.100.3 with the fixes in this PR).What's in scope vs out
hosting/old/.41-release-to-public.ymlworkflow change that adds Helm publishing — lives in the platform repo. Templated service deployments (chart only provisions the services gateway, not the per-template service deployments) — same as v0.100.1 behavior, not introduced or changed here.