Add Helm chart for Kubernetes deployment of Plane - #1
Closed
crewletbot wants to merge 2 commits into
Closed
Conversation
crewletbot
force-pushed
the
claude/plane-infralet-deploy-oqfb82
branch
from
August 17, 2026 20:32
c5c6c1d to
59ce6a1
Compare
Upstream ships compose, swarm and AIO deployments plus a link to makeplane's chart on Artifact Hub, but nothing that fits how this fork is actually run: a shared RDS instance instead of a bundled Postgres, S3 with IRSA instead of MinIO, and ingress through a Cloudflare Tunnel instead of a load balancer. The chart deploys all six images this repository publishes to GHCR -- proxy, web, space, admin, live and backend (as api, worker, beat and a migration job) -- plus the Valkey and RabbitMQ they depend on. Because the images sit side by side under one namespace, image.repository is treated as a prefix that each component completes with its own suffix; a single repository/tag pair then configures all six, which is what lets a generic GitOps Application template drive a multi-image chart. Caddy keeps the path split from apps/proxy/Caddyfile.ce but drops the MinIO route and listens on 8080, so it needs no NET_BIND_SERVICE capability. The migration job runs as a pre-install/pre-upgrade hook, which Argo CD maps onto PreSync, so the schema is current before any new pod starts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY defaulted to the literal strings "access-key" and "secret-key". Anything reading them through django settings -- the workspace export task and the expired-export cleanup task both build their own boto3 client that way -- therefore handed S3 a placeholder key whenever the variables were unset, and got InvalidAccessKeyId back instead of falling through to boto3's credential chain. That is exactly how a deployment on an instance profile or an EKS service account role is configured: no keys in the environment at all. S3Storage already got this right by reading os.environ directly with no default, so uploads worked while exports did not. The placeholders only ever fitted the bundled MinIO, and both compose files set the pair explicitly, so nothing that relied on them loses it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
crewletbot
force-pushed
the
claude/plane-infralet-deploy-oqfb82
branch
from
August 17, 2026 20:41
59ce6a1 to
6138b3b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces a Helm chart for deploying Plane (community edition) on Kubernetes. The chart packages all Plane components (web, space, admin, live, api, worker, beat) along with the Valkey and RabbitMQ they depend on into a single, configurable release.
Key features:
image.repositoryis a prefix that each component completes with its own suffix, so one repository/tag pair configures all six images — which is what lets a generic GitOps Application template drive a multi-image chartLoadBalancerService, or an outbound tunnel at theplane-proxyServicepre-install,pre-upgradehook so the schema is current before any new pod startsRelated files:
deployments/helm/plane/Chart.yaml: chart metadatadeployments/helm/plane/values.yaml: configuration, commented key by keydeployments/helm/plane/README.md: user documentationdeployments/helm/plane/templates/: all Kubernetes resource templatesapps/api/plane/settings/common.py: let the AWS credential settings fall through to the role instead of defaulting to placeholder keysType of Change
Test Scenarios
Validated with:
helm lint— cleanhelm templatewith chart defaults, and with a GitOps-style values overlay; rendered manifests parsed and asserted (image references resolve per component, service account annotation lands, no static AWS credentials emitted, secret wiring correct)helm templatewithsecrets.create=true, including the guards that fail the render when a required secret value is missingNot run here: the Django test suite, which needs Docker (unavailable in the environment this was authored in). CI covers it.
References