Skip to content

Deploy manually

Jump to bottom
Valentin Ryckaert edited this page Jul 22, 2026 · 7 revisions

HEP Training configuration

You must already have your own HEP Training repo. Copy the .env, tess.yml and secrets.yml of your TeSS instance in the templates/config of this repo.

There are some modifications to be aware of:

  1. In .env, Solr and Redis URL must be labelled with -service when deploying through Kubernetes:
SOLR_URL=http://solr-service:8983/solr/tess
REDIS_URL=redis://redis-service:6379/1
REDIS_TEST_URL=redis://redis-service:6379/0

  1. In .env, Database host should be set up with DB_HOST=db-service, be sure also to have same port in .env and in db.port of values.yaml.

  2. In tess.yml change base_url with your final URL.

Build and push your TeSS image in a container registry

Why: We don't want to bake credentials in the image (i.e., leaving .env, tess.yml and secrets.yml in the image), instead we will setup Secrets with these three files.

We will use ghcr.io (GitHub Container Registry, see documentation). Your packages can be found in your GitHub Profile, Packages tab. You should have none or you may already have your own if you already used this service.

Build and push the app

⚠️ Make sure to have the same .env, tess.yml and secrets.yml in both your TeSS and TeSS-Helm-chart directories.

Execute the following command in your terminal at the root of your TeSS directory, do not forget to change it with your own GitHub username, the name you want to give to your image and change the tag when you re/build it (if you are on an arm64 machine, replace linux/amd64 by linux/arm64 on the next command):

docker build -f Dockerfile . --build-arg CR="True" -t ghcr.io/YOUR_GITHUB_USERNAME/YOUR_IMAGE_NAME:0.1.0 --platform linux/amd64

To check that your image does not contain any credentials/sensitive information, you can run a find command in your image with the following command:

docker run --rm -it ghcr.io/YOUR_GITHUB_USERNAME/YOUR_IMAGE_NAME:0.1.0 find -L \( -path "./*tess*" -o -path "./*secrets*" -o -path "./*env*" \) | grep -iw ".env\|tess.yml\|secrets.yml"

The output should only show env.sample and another tess.yml files.

Now that you are sure that neither .env, tess.yml nor secrets.yml are baked in your image you can push it on ghcr.io. Back to your terminal, you can execute this command:

docker push ghcr.io/YOUR_GITHUB_USERNAME/YOUR_IMAGE_NAME:0.1.0

Your TeSS image is now on GitHub, without credentials and private 🎉

Allow Kubernetes to pull your private image

If your image/package is still Private, to be able to pull it, you must configure a Secret. Execute the following command, change username, password and email with your GitHub credentials, and be at the root of the Helm chart directory:

kubectl create secret docker-registry app-secrets-ghcr --docker-server=https://ghcr.io --docker-username=YOUR_GITHUB_USERNAME --docker-password=YOUR_GITHUB_TOKEN --docker-email=YOUR_EMAIL --dry-run=client -o yaml > templates/app-secrets-ghcr.yaml

A small explanation here. This secret is now labelled as app-secrets-ghcr and when any Kubernetes manifest will try to pull your image as specified under image it will use the secret under imagePullSecrets.

Set up .env, tess.yml and secrets.yml as secrets

Since none of these files are baked in your image, we will set them up as Secrets:

kubectl create secret generic app-secrets-env --from-env-file=templates/config/.env --dry-run=client -o yaml > templates/app-secrets-env.yaml
kubectl create secret generic app-secrets-config --from-file=templates/config/secrets.yml --from-file=templates/config/tess.yml --dry-run=client -o yaml > templates/app-secrets-config.yaml

Deploy / Install the chart

Connect to your cluster and run:

helm install tess .

To make changes:

Re-do the secrets setup step. Then:

helm upgrade tess . -f values.yaml

🎉 You can now browse your TeSS instance at your specified URL.

Uninstall

helm uninstall tess

Clone this wiki locally