adityamparikh opened a new issue, #227:
URL: https://github.com/apache/solr-mcp/issues/227
### Current state (verified)
No `deploy/` directory, no chart, no Kubernetes manifests. Image publishing
is handled by `build-and-publish.yml` / `release-publish.yml` (#174 is
repairing them).
### Scope
`deploy/helm/solr-mcp/` — `Chart.yaml`, `values.yaml`,
`templates/{deployment,service,ingress,serviceaccount,networkpolicy,servicemonitor}.yaml`,
`NOTES.txt`; docs page under `docs/`.
```yaml
solrCloud:
name: films # required
namespace: "" # default: release namespace
commonServicePort: 80 # operator default; 443 when spec.solrTLS is set
tls:
enabled: false
caSecretName: "" # secret holding the signing CA
caKey: ca.crt
auth:
enabled: true
secretName: "" # default: <name>-solrcloud-security-bootstrap
usernameKey: admin # see note
mcp:
security:
enabled: true
issuerUri: "" # OAUTH2_ISSUER_URI
replicas: 1
resources: {}
ingress: { enabled: false }
serviceMonitor: { enabled: false }
networkPolicy: { enabled: true }
```
Derived env:
`SOLR_URL={http|https}://{name}-solrcloud-common.{ns}:{port}/solr/`,
`SOLR_USERNAME={usernameKey}`, `SOLR_PASSWORD` from `secretKeyRef{name:
secretName, key: usernameKey}`, `SOLR_TLS_CA_PEM` from a mounted CA secret
(#222), `PROFILES=http`, `OAUTH2_ISSUER_URI`. Probes on the actuator health
endpoints. ServiceAccount with no Role. NetworkPolicy egress to the common
service and the issuer only.
**Operator facts the chart relies on (verified in operator v0.9 docs):**
common service `<name>-solrcloud-common`; `<name>-solrcloud-basic-auth` holds
only the `k8s-oper` probe user — never use it;
`<name>-solrcloud-security-bootstrap` holds `admin`, `solr`, `k8s-oper`
passwords keyed by username; default authorization gives `solr` read-only,
`update`/`security-*`/`all` are `admin`-only — hence `usernameKey: admin`, with
a note recommending a purpose-made user via the Security API.
### Acceptance
- [ ] `helm lint` + `helm template` in `ci.yml`.
- [ ] Chart published on tag to the same registry as the image, by whatever
the release workflows settle on (**verify** registry with #174).
- [ ] Docs page: one-line install, `usernameKey` note, how to point at a
user-provided `security.json` secret.
- [ ] `NOTES.txt` prints the endpoint and the `kubectl get secret … | base64
-d` command, never a password.
### Depends on
#222, #174.
Part of the Kubernetes / Solr Operator integration tracking issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
