feat(deploy): Helm chart for ourios-server (shipping milestone C)

[jensholdgaard]

What

First-shipping-milestone workstream C: a Helm chart at deploy/helm/ourios — the first deployable packaging of ourios-server. Scaffolded with helm create, then customized. (CLAUDE.md §7 already lists deploy/helm/ as a target artifact; no Ourios RFC is needed for a standard k8s packaging concern.)

Design

ourios-server runs all three roles in one process — always-on compactor + optional receiver (RFC 0003) + optional querier (RFC 0016) — so the chart deploys it as a single StatefulSet with roles toggled via roles.receiver.enabled / roles.querier.enabled. Two PVCs: data (OURIOS_BUCKET_ROOT, the Parquet store) and wal (OURIOS_WAL_ROOT, receiver-only).

⚠️ Topology decision — flagging for review. This is a single replica on a ReadWriteOnce data volume. Reason: the object-storage backend (RFC 0013 is still red — local-filesystem only), so cross-pod store sharing would require RWX (not available on vanilla clusters / kind), and the compactor is the store's single writer. This is the only shape that deploys anywhere today. When S3 lands, the store is shared via object storage and the querier splits into its own horizontally-scaled Deployment — the chart is structured (role toggles, separate concerns) to make that evolution clean. If you'd prefer a split-now chart gated on RWX, say so and I'll restructure.

Details:

• Image: ghcr.io/jensholdgaard/ourios (the published distroless build), tag → chart appVersion, overridable via image.tag.
• Security: nonroot (uid 65532), read-only root filesystem, dropped capabilities; fsGroup lets the process write its PVCs; a tmp emptyDir covers the read-only rootfs.
• Services: a headless service governs the StatefulSet; a client ClusterIP exposes only the enabled roles' ports (4317/4318 receiver, 4319 querier).
• Probes: tcpSocket on an enabled role port (no HTTP health route exists yet — endpoints are POST-only; a compactor-only pod gets no probe).
• helm test: posts a DSL query to the querier (or TCP-checks the receiver).

Verification

• helm lint clean.
• helm template renders valid manifests across the full role-toggle matrix (both / querier-only / receiver-only / compactor-only) — conditional env, ports, PVCs, probes, and services all gate correctly (verified locally).
• CI: .github/workflows/helm.yml runs helm lint + the helm template matrix on changes under deploy/helm/ — SHA-pinned azure/setup-helm (v5.0.0), least-priv contents: read, path-filtered. Renovate already manages action pins.

Out of scope / follow-ups

• S3-backed multi-workload topology (waits on RFC 0013 green).
• An HTTP health/readiness endpoint (would replace the tcpSocket probes).
• An mdBook deployment page (docs follow-up).
• gRPC ingress / Gateway API (the scaffold's ingress/HTTPRoute were dropped; OTLP gRPC ingress is non-trivial and deferred).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added Helm chart for Ourios deployment with configurable roles (OTLP receiver, HTTP querier, background compactor)
  • Persistent volume support for data and transaction logs
  • Includes comprehensive documentation and post-installation guidance
  • Built-in test verification

• Chores

  • Added GitHub Actions workflow for automated Helm chart validation on pull requests and main branch updates

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Introduces a complete Helm chart for the ourios application under deploy/helm/ourios/, consisting of a StatefulSet with role-toggling for an OTLP receiver, querier, and always-on compactor, along with supporting Services, ServiceAccount, helper templates, default values, post-install NOTES, a Helm test hook, README documentation, and a GitHub Actions workflow that lints and render-tests the chart across the role-toggle matrix.

Changes

ourios Helm chart and CI workflow

Layer / File(s)	Summary
Chart metadata and default values deploy/helm/ourios/.helmignore, deploy/helm/ourios/Chart.yaml, deploy/helm/ourios/values.yaml	Defines chart identity, establishes all default values (roles, persistence, security contexts, ports, OTEL, scheduling), and provides the .helmignore exclusion list.
Template helper functions deploy/helm/ourios/templates/_helpers.tpl	Implements naming helpers (ourios.name, ourios.fullname, ourios.chart), label helpers (ourios.labels, ourios.selectorLabels), service account name selection, image reference construction, and role-conditional environment variable generation via ourios.env.
StatefulSet, Services, and ServiceAccount deploy/helm/ourios/templates/statefulset.yaml, deploy/helm/ourios/templates/service.yaml, deploy/helm/ourios/templates/serviceaccount.yaml	Implements the single-replica StatefulSet with role-conditional ports, TCP probes, persistent data/wal volumeClaimTemplates, and /tmp emptyDir. Adds headless and client-facing Services with role-conditional port exposure (receiver: 4317/4318, querier: 4319). Adds a conditional ServiceAccount.
Test hook, NOTES, and README deploy/helm/ourios/templates/tests/test-connection.yaml, deploy/helm/ourios/templates/NOTES.txt, deploy/helm/ourios/README.md	Adds a Helm test hook Pod running either a wget query smoke test or nc connectivity check based on enabled roles. Adds NOTES.txt with role status, storage layout, port-forward instructions, and compactor-only guidance. Adds README with topology, install commands, key values table, and security notes.
GitHub Actions Helm lint and render workflow .github/workflows/helm.yml	Adds a workflow triggered on PRs and pushes to main scoped to deploy/helm/** changes. Configures concurrency (cancel non-main), read-only permissions, and a chart job running helm lint plus helm template for all four role-toggle combinations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 Hop hop, the chart is born today,
A StatefulSet to store your WAL away.
Compactor runs through day and night,
While receiver and querier toggle right.
helm install and watch it grow —
Parquet petals, row by row! 🌸

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description is comprehensive and well-structured, covering what, design, verification, and follow-ups. However, it does not follow the repository's PR description template (missing Checklist section with cargo fmt, clippy, tests, and docs updates).	Add the Checklist section from the template to confirm cargo fmt/clippy status, test coverage, docs/CHANGELOG updates, and RFC links (if applicable).

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: introducing a Helm chart for the ourios-server application as part of the shipping milestone C.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch helm-chart-shipping-c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jensholdgaard]

Parking this in favour of doing S3 Store selection first, then rebuilding the chart S3-native.

Rationale (per maintainer): CLAUDE.md §3.6 makes object storage the source of truth for the Parquet data store — but the server only wires Store::local(OURIOS_BUCKET_ROOT) today (receiver.rs:240: "S3 selection … is the RFC 0014 §7 follow-on"), so this chart had to back the data store with a local PVC + single replica. That's a stopgap that contradicts the intended architecture.

Plan: wire S3 selection in ourios-server (so OURIOS_BUCKET_ROOT / an S3 config selects an object-storage backend), then re-open a chart where the data store is S3 (no data PVC), only the WAL is a PVC, and the querier splits into its own scalable Deployment. The branch is kept; most of the chart work carries over.

[Copilot]

Pull request overview

Adds a first deployable Kubernetes packaging for ourios-server by introducing a Helm chart (deploy/helm/ourios) and CI validation to lint and render-test the chart across the role-toggle matrix (receiver / querier / compactor-only).

Changes:

• Added a Helm v3 chart that deploys ourios-server as a single-replica StatefulSet with role toggles and PVC-backed data + optional wal.
• Added services, notes, and a helm test hook pod to smoke-check connectivity/querying depending on enabled roles.
• Added a GitHub Actions workflow to run helm lint and helm template for changes under deploy/helm/.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
deploy/helm/ourios/Chart.yaml	Defines the new ourios Helm chart metadata (type, versions, description).
deploy/helm/ourios/values.yaml	Introduces chart configuration (image, role toggles, persistence, security contexts, env knobs).
deploy/helm/ourios/templates/_helpers.tpl	Adds shared naming/label helpers plus env and image construction helpers.
deploy/helm/ourios/templates/statefulset.yaml	Implements the core StatefulSet deployment with conditional ports/probes/PVCs by role.
deploy/helm/ourios/templates/service.yaml	Adds headless service for StatefulSet identity and a conditional client-facing service.
deploy/helm/ourios/templates/serviceaccount.yaml	Adds an optional ServiceAccount with configurable automount behavior.
deploy/helm/ourios/templates/tests/test-connection.yaml	Adds helm test hook pod to validate querier/receiver reachability.
deploy/helm/ourios/templates/NOTES.txt	Provides post-install guidance and role/port hints.
deploy/helm/ourios/README.md	Documents installation, topology constraints, and key values.
deploy/helm/ourios/.helmignore	Adds standard Helm ignore patterns for packaging.
.github/workflows/helm.yml	Adds CI workflow to lint and render-test the Helm chart on relevant changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.