Skip to content

♻️(tilt) use hem dev-backend chart #683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

♻️(tilt) use hem dev-backend chart #683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions bin/Tiltfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,12 +85,13 @@ clean_old_images('localhost:5001/meet-livekit')

k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev} template .'))

k8s_resource('minio-bucket', resource_deps=['minio'])
k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
k8s_resource('meet-backend', resource_deps=['dev-backend-redis', 'dev-backend-keycloak', 'dev-backend-postgres', 'livekit-livekit-server', 'dev-backend-minio:statefulset'])
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify if meet-summary and meet-celery resources need explicit dependencies

The meet-backend resource has comprehensive dependencies, but there's no explicit resource definition for meet-summary and meet-celery services that also depend on Redis and MinIO.

🏁 Script executed:

#!/bin/bash
# Description: Check if summary and celery resources are defined elsewhere

# Search for k8s_resource definitions for summary and celery
echo "=== Searching for summary and celery resource definitions ==="
rg "k8s_resource.*summary|k8s_resource.*celery" bin/

# Check if they are created as part of the helm template
echo -e "\n=== Checking helm templates for summary/celery deployments ==="
fd -e yaml . src/helm/meet/templates --exec grep -l "summary\|celery" {} \;

Length of output: 545

Add Tilt k8s_resource definitions for meet-summary and meet-celery

bin/Tiltfile lacks k8s_resource entries for meet-summary and meet-celery even though their helm templates exist. Both depend on Redis and MinIO—add:

  • k8s_resource('meet-summary', resource_deps=['dev-backend-redis', 'dev-backend-minio:statefulset'])
  • k8s_resource('meet-celery', resource_deps=['dev-backend-redis', 'dev-backend-minio:statefulset'])
🤖 Prompt for AI Agents 
In bin/Tiltfile around line 88, the file is missing k8s_resource entries for
meet-summary and meet-celery; add two k8s_resource declarations for these
services with the correct dependencies—each should list dev-backend-redis and
dev-backend-minio:statefulset as resource_deps so Tilt manages their watch/order
alongside existing resources.

k8s_resource('meet-backend-migrate', resource_deps=['dev-backend-postgres'])
k8s_resource('livekit-livekit-server', resource_deps=['dev-backend-redis'])
k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
k8s_resource('keycloak', resource_deps=['kc-postgresql'])
k8s_resource('meet-backend-createsuperuser', resource_deps=['meet-backend-migrate'])
k8s_resource('dev-backend-keycloak', resource_deps=['dev-backend-keycloak-pg'])
k8s_resource('livekit-egress', resource_deps=['livekit-livekit-server'])

migration = '''
set -eu
Expand Down
3 changes: 2 additions & 1 deletion src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,9 @@ egress:
{{- end }}
{{- end }}
redis:
address: redis-master:6379
address: dev-backend-redis:6379
password: pass
username: user
s3:
Comment on lines +16 to 19
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Redis ACL username likely incorrect; use 'default' or parametrize via secret

Mirror the shared dev-backend Redis ACL user.

-    username: user
+    username: default
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
address: dev-backend-redis:6379
password: pass
username: user
s3:
address: dev-backend-redis:6379
password: pass
username: default
s3:
🤖 Prompt for AI Agents 
In src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl around lines 16 to 19, the
Redis ACL username is set to "user" which likely doesn't match the shared
dev-backend Redis ACL; update the username to the correct ACL user (e.g.,
"default") or parameterize it so it is sourced from a secret/value (add a
template variable like .Values.redis.username or reference a Kubernetes secret
key) and ensure the chart values or secret for dev-backend provide the mirrored
ACL username.

access_key: meet
secret: password
Expand Down
3 changes: 2 additions & 1 deletion src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@ livekit:
port_range_end: 60000
tcp_port: 7881
redis:
address: redis-master:6379
address: dev-backend-redis:6379
password: pass
username: user
Comment on lines +17 to +19
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Redis ACL username should match dev-backend-redis (likely 'default')

To avoid NOAUTH errors, align with the Redis chart’s ACL user (commonly 'default').

-    username: user
+    username: default
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
address: dev-backend-redis:6379
password: pass
username: user
address: dev-backend-redis:6379
password: pass
username: default
🤖 Prompt for AI Agents 
In src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl around lines 17-19, the
Redis ACL username currently is "user" which likely mismatches the Redis chart's
ACL (commonly "default"); update the username entry to match the chart (e.g.,
change username: user to username: default) so the deployed LiveKit uses the
same Redis ACL user and avoids NOAUTH errors.

keys:
turn:
enabled: true
Expand Down
23 changes: 16 additions & 7 deletions src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,21 @@ backend:
LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
DB_HOST: postgres
DB_NAME: meet
DB_USER: dinum
DB_PASSWORD: pass
DB_HOST: dev-backend-postgres
DB_NAME:
secretKeyRef:
name: dev-backend-postgres
key: database
DB_USER:
secretKeyRef:
name: dev-backend-postgres
key: username
DB_PASSWORD:
secretKeyRef:
name: dev-backend-postgres
key: password
DB_PORT: 5432
REDIS_URL: redis://default:pass@redis-master:6379/1
REDIS_URL: redis://user:pass@dev-backend-redis:6379/1
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Redis configuration inconsistency detected

The Redis URL format differs across services:

  • Backend (line 52): Uses redis://user:pass@dev-backend-redis:6379/1
  • Summary/Celery (lines 163-164, 196-197): Still reference old Redis with redis://default:pass@redis-master:6379/1

This inconsistency will cause connection failures for the summary and celery services.

Apply this diff to fix the Redis URL inconsistency:

-    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
-    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    CELERY_BROKER_URL: redis://user:pass@dev-backend-redis:6379/1
+    CELERY_RESULT_BACKEND: redis://user:pass@dev-backend-redis:6379/1

Also applies to: 163-164, 196-197

🤖 Prompt for AI Agents 
In src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl around line 52 (and also at
lines 163-164 and 196-197), the Redis URLs are inconsistent—backend uses
redis://user:pass@dev-backend-redis:6379/1 while summary/celery still point to
redis://default:pass@redis-master:6379/1; update the Redis URL values at lines
163-164 and 196-197 to match the backend URL
(redis://user:pass@dev-backend-redis:6379/1) so all services use the same host,
user, password and DB index, and verify there are no other stale redis URLs
elsewhere in this template.

STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
{{- with .Values.livekit.keys }}
{{- range $key, $value := . }}
Expand All @@ -58,8 +67,8 @@ backend:
FRONTEND_USE_FRENCH_GOV_FOOTER: True
FRONTEND_USE_PROCONNECT_BUTTON: True
FRONTEND_MANIFEST_LINK: "https://docs.numerique.gouv.fr/docs/1ef86abf-f7e0-46ce-b6c7-8be8b8af4c3d/"
AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: meet
AWS_S3_ENDPOINT_URL: http://dev-backend-minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: dinum
AWS_S3_SECRET_ACCESS_KEY: password
Comment on lines +70 to 72
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

S3 configuration inconsistency across services

The S3 configuration is partially updated:

  • Backend (lines 70-72): Correctly uses dev-backend-minio with dinum access key
  • Summary/Celery (lines 153-155, 186-188): Still use old minio.meet.svc.cluster.local:9000 endpoint and meet access key

This will cause S3 connection failures for summary and celery services.

Apply this diff to fix the S3 configuration:

For summary service (around lines 153-155):

-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_ENDPOINT_URL: http://dev-backend-minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: dinum

For celery service (around lines 186-188):

-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_ENDPOINT_URL: http://dev-backend-minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: dinum

Also applies to: 153-155, 186-188

🤖 Prompt for AI Agents 
In src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl around lines 70-72, 153-155
and 186-188, the summary and celery S3 settings still point to the old minio
host and use the `meet` access key causing connection failures; update the
AWS_S3_ENDPOINT_URL for summary (lines ~153-155) and celery (lines ~186-188) to
use http://dev-backend-minio.meet.svc.cluster.local:9000 and set
AWS_S3_ACCESS_KEY_ID to dinum and AWS_S3_SECRET_ACCESS_KEY to password so they
match the backend configuration used at lines 70-72.

AWS_STORAGE_BUCKET_NAME: meet-media-storage
AWS_S3_REGION_NAME: local
Expand Down
3 changes: 2 additions & 1 deletion src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,9 @@ egress:
{{- end }}
{{- end }}
redis:
address: redis-master:6379
address: dev-backend-redis:6379
password: pass
username: user
s3:
access_key: meet
secret: password
Expand Down
3 changes: 2 additions & 1 deletion src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@ livekit:
port_range_end: 60000
tcp_port: 7881
redis:
address: redis-master:6379
address: dev-backend-redis:6379
password: pass
username: user
Comment on lines +17 to +19
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Redis ACL username should match dev-backend-redis (likely 'default')

Same rationale as other env files; keep credentials consistent with the shared Redis.

-    username: user
+    username: default
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
address: dev-backend-redis:6379
password: pass
username: user
address: dev-backend-redis:6379
password: pass
username: default
🤖 Prompt for AI Agents 
In src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl around lines 17 to 19,
the Redis ACL username is set to "user" but should match the shared
dev-backend-redis ACL (likely "default"); change the username value to "default"
(or the exact ACL principal used by dev-backend-redis) so credentials are
consistent with other environment files and the shared Redis instance.

keys:
turn:
enabled: true
Expand Down
23 changes: 16 additions & 7 deletions src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,21 @@ backend:
LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
DB_HOST: postgres
DB_NAME: meet
DB_USER: dinum
DB_PASSWORD: pass
DB_HOST: dev-backend-postgres
DB_NAME:
secretKeyRef:
name: dev-backend-postgres
key: database
DB_USER:
secretKeyRef:
name: dev-backend-postgres
key: username
DB_PASSWORD:
secretKeyRef:
name: dev-backend-postgres
key: password
DB_PORT: 5432
REDIS_URL: redis://default:pass@redis-master:6379/1
REDIS_URL: redis://user:pass@dev-backend-redis:6379/1
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
{{- with .Values.livekit.keys }}
{{- range $key, $value := . }}
Expand All @@ -57,8 +66,8 @@ backend:
FRONTEND_TRANSCRIPT: "{'form_beta_users': 'https://grist.numerique.gouv.fr/o/docs/forms/3fFfvJoTBEQ6ZiMi8zsQwX/17'}"
FRONTEND_FEEDBACK: "{'url': 'https://grist.numerique.gouv.fr/o/docs/cbMv4G7pLY3Z/USER-RESEARCH-or-LA-SUITE/f/26'}"
FRONTEND_MANIFEST_LINK: "https://docs.numerique.gouv.fr/docs/1ef86abf-f7e0-46ce-b6c7-8be8b8af4c3d/"
AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: meet
AWS_S3_ENDPOINT_URL: http://dev-backend-minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: dinum
AWS_S3_SECRET_ACCESS_KEY: password
Comment on lines +69 to 71
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Align MinIO endpoint/keys with dev-backend across all components

Backend now targets dev-backend-minio with AKID=dinum. Summary and Celery still point to old MinIO/creds (see Lines 159-161 and 193-195) and will break after consolidation. Please update them too (separate comments below).

🏁 Script executed:

#!/bin/bash
set -e

# locate the template file
echo "Locating values.meet.yaml.gotmpl:"
fd values.meet.yaml.gotmpl

# show all AWS_S3_* occurrences with context
echo -e "\nAWS_S3_* entries with context:"
rg -n 'AWS_S3_' -C2 src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

# locate Summary block around AWS_S3 entries
echo -e "\nContext around 'Summary':"
rg -n 'Summary' -C3 src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

# locate Celery block around AWS_S3 entries
echo -e "\nContext around 'Celery':"
rg -n 'Celery' -C3 src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

Length of output: 2207

Align Summary & Celery MinIO config

Update AWS_S3_ENDPOINT_URL, AWS_S3_ACCESS_KEY_ID and AWS_S3_SECRET_ACCESS_KEY in src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl to match the backend’s dev-backend-minio settings:

  • Summary block (lines 159–161): replace
    minio.meet.svc.cluster.local:9000 / meet / password
    with
    http://dev-backend-minio.meet.svc.cluster.local:9000 / dinum / password
  • Celery block (lines 193–195): apply the same replacements
🤖 Prompt for AI Agents 
In src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl (current snippet lines
~69–71) and specifically update the Summary block at lines 159–161 and the
Celery block at lines 193–195: replace the S3 endpoint, access key and secret to
match the backend dev-backend-minio settings by using AWS_S3_ENDPOINT_URL =
http://dev-backend-minio.meet.svc.cluster.local:9000, AWS_S3_ACCESS_KEY_ID =
dinum, and AWS_S3_SECRET_ACCESS_KEY = password so both Summary and Celery blocks
match the backend configuration.

AWS_STORAGE_BUCKET_NAME: meet-media-storage
AWS_S3_REGION_NAME: local
Expand Down
3 changes: 2 additions & 1 deletion src/helm/env.d/dev/values.egress.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,9 @@ egress:
{{- end }}
{{- end }}
redis:
address: redis-master:6379
address: dev-backend-redis:6379
password: pass
username: user
s3:
access_key: meet
secret: password
Expand Down
3 changes: 2 additions & 1 deletion src/helm/env.d/dev/values.livekit.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@ livekit:
port_range_end: 60000
tcp_port: 7881
redis:
address: redis-master:6379
address: dev-backend-redis:6379
password: pass
username: user
Comment on lines +17 to +19
Copy link

@coderabbitai coderabbitai bot Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Redis ACL username should match dev-backend-redis (likely 'default')

Ensure LiveKit can authenticate against the new Redis instance.

-    username: user
+    username: default
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
address: dev-backend-redis:6379
password: pass
username: user
address: dev-backend-redis:6379
password: pass
username: default
🤖 Prompt for AI Agents 
In src/helm/env.d/dev/values.livekit.yaml.gotmpl around lines 17 to 19, the
Redis ACL username is set to "user" but the dev-backend-redis instance expects
the default ACL username (likely "default"); update the username field to
"default" (or to the exact ACL username configured on dev-backend-redis) so
LiveKit can authenticate, and verify the password value matches the Redis ACL
credential.

keys:
turn:
enabled: true
Expand Down
23 changes: 16 additions & 7 deletions src/helm/env.d/dev/values.meet.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,12 +57,21 @@ backend:
LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
DB_HOST: postgres
DB_NAME: meet
DB_USER: dinum
DB_PASSWORD: pass
DB_HOST: dev-backend-postgres
DB_NAME:
secretKeyRef:
name: dev-backend-postgres
key: database
DB_USER:
secretKeyRef:
name: dev-backend-postgres
key: username
DB_PASSWORD:
secretKeyRef:
name: dev-backend-postgres
key: password
DB_PORT: 5432
REDIS_URL: redis://default:pass@redis-master:6379/1
REDIS_URL: redis://user:pass@dev-backend-redis:6379/1
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
{{- with .Values.livekit.keys }}
{{- range $key, $value := . }}
Expand All @@ -74,8 +83,8 @@ backend:
ALLOW_UNREGISTERED_ROOMS: False
FRONTEND_SILENCE_LIVEKIT_DEBUG: False
FRONTEND_SUPPORT: "{'id': '58ea6697-8eba-4492-bc59-ad6562585041'}"
AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: meet
AWS_S3_ENDPOINT_URL: http://dev-backend-minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: dinum
AWS_S3_SECRET_ACCESS_KEY: password
AWS_STORAGE_BUCKET_NAME: meet-media-storage
AWS_S3_REGION_NAME: local
Expand Down
61 changes: 0 additions & 61 deletions src/helm/extra/templates/kc-postgresql-sts.yaml
View file
Open in desktop

This file was deleted.

104 changes: 0 additions & 104 deletions src/helm/extra/templates/keycloak-sts.yaml
View file
Open in desktop

This file was deleted.

Loading
Loading