Platform Deployment

Helm Charts

Each service has its own chart in deploy/. On a release tag the pipeline also packages both charts with the tag as their version and publishes them to the shared Helm repository.

Backend

deploy/backend/helm (promethist-platform-backend) contains:

  • the Deployment, with JAVA_OPTS sized by RAM percentage, the OpenTelemetry agent and OTLP exporter settings (Observability), and checksum annotations that roll the pods whenever the rendered ConfigMap or a testing credential changes;

  • a Service exposing port 80 (HTTP, to 9310) and 81 (Socket.IO, to 9311);

  • the Ingress of the whole host — frontend, backend, engine and client routes, see Request Routing — and the optional legacy Ingress;

  • the ConfigMap with the environment-specific properties, and the {release}-testing Secret (Configuration and Secrets);

  • a ServiceMonitor for /actuator/prometheus, which as written matches no port of the Service (see Prometheus);

  • the ExternalName service to the engine for namespaces that have no engine of their own.

The values a deployment usually sets:

Value Meaning

app.domain, app.suffix

The host is {suffix}.{domain}, or just {domain} without a suffix.

app.image, app.tag

The image and its tag — the short commit SHA for merge requests, the Git tag for a release.

app.engineName, app.engineNamespace

The engine service the Ingress routes to, and the namespace whose engine an issue namespace reaches through the ExternalName service (promethist-engine in default).

app.bridgeSecretToken, app.engineBasicIdentity

The test credentials written into the {release}-testing Secret. Empty values leave test suites, or sign-in-gated live tests, unavailable.

replicas, spotInstance, app.resources

One replica with 3.5 GiB of memory by default; issue environments run on spot nodes with 1 GiB.

app.javaOpts

-XX:MaxRAMPercentage=55: the JVM heap takes 55 % of the memory, about 2 GiB by default. The rest is the JVM’s other memory and room for ffmpeg, which re-encodes uploaded videos in the same container (Re-encoding of Uploaded Videos). Issue environments keep 65 %.

app.videoTranscoding

Whether uploaded videos are re-encoded (promethist.video-transcoding.enabled in the ConfigMap), on by default. Issue environments switch it off: ffmpeg does not fit beside the JVM in their 1 GiB.

app.legacyClient

Adds the legacy Ingress on legacy[-<suffix>].<domain> (on by default).

Frontend

deploy/frontend/helm (promethist-platform-frontend) is a Deployment and a Service on port 3000. All of its configuration is inside the image, which the pipeline builds per target environment (Container Images).

How a Deploy Runs

Every deployment follows the same shape — helm upgrade --install of the chart with the environment’s specifics passed as --set values:

helm -n $NAMESPACE upgrade --force --install promethist-platform-backend deploy/backend/helm \
  --set app.name=backend \
  --set app.suffix=$SUFFIX \
  --set app.namespace=$NAMESPACE \
  --set app.image=$CI_REGISTRY_IMAGE/backend \
  --set app.tag=$IMAGE_TAG \
  --set app.domain=$DOMAIN \
  --set app.bridgeSecretToken="$BRIDGE_SECRET_TOKEN" \
  --set app.engineBasicIdentity="$ENGINE_BASIC_IDENTITY"

The same command, with an older app.tag, rolls a deployment back. A rollback leaves the database as the newer version’s startup migrations wrote it; after rolling back past evaluation versioning, leave evaluations and the evaluations of agents unedited until the platform is forward again (Data Saved Before Versioning).

An issue deployment first runs deploy/prepare-namespace.sh, which creates the per-issue namespace on its first run and installs the Azure Key Vault secret provider (deploy/secret-provider.yaml) into it.