Helm backend #9

skkra0 · 2026-01-02T21:00:58Z

Changes

/chart

Created a chart for installing Spilo, based on this config from the spilo repository
- The annotations field on the Chart.yaml is used for anvilops-specific metadata. For instance, under the key anvilops-values is some JSON that could be used for generating form fields for the chart on the frontend.
Added some environment variables.

/openapi

Added an endpoint for listing available AnvilOps charts. This returns some information on the Spilo chart.
Added a third source for configs, helm.
Request schemas for createApp and createAppGroup use the DeploymentConfig object.
- This means the cpu and memory are formatted on the frontend.
Split DeploymentConfig into two schemas, WorkloadConfigOptions(appType: "workload", source: git or image) and HelmConfigOptions(appType: "helm", source: helm).
- WorkloadConfigOptions contains fields that are common between git and image configs e.g. port, subdomain, collectLogs. It also has either git config fields(source: "git", dockerfilePath, builder, repositoryId, etc) or image config fields(just imageTag).

/backend

/prisma

Wrote a migration that adds new enums and creates a HelmConfig table, renames the DeploymentConfig table to WorkloadConfig and renames related items accordingly, then recreates DeploymentConfig. It contains an appType, which indicates whether to point to a WorkloadConfig or a HelmConfig. The configId on App and Deployment still point to a DeploymentConfig.

/db

Added WorkloadConfig(create), GitConfig(create), and HelmConfig(create) types and updated the repos
- I tried to largely hide how the different types of configs are actually represented in the database. The repos add the appropriate appType and source fields before returning config objects, and those fields are also used to decide how to insert a new config.
- To avoid confusion, ids are omitted from the config objects. The id of a config is never used, since an update always results in a new Deployment and DeploymentConfig.

/lib

Installed helm in the backend and wrote a module for running helm to retrieve and upgrade charts.
Added some environment variables.

/service

Updated handlers for helm and workload configs
Wrote some -Service classes to simplify handler implementations
- Moved config generation and validating logic to a class DeploymentConfigService. It is also responsible for picking up the commitHash and commitMessage of a git config.
- Moved some logic for validating apps to a class AppService, which calls methods of DeploymentConfigService
- Moved deployment and deployment canceling logic under a class DeploymentService
- Many of the dependencies of the classes are passed into the constructor. This can be useful for testing, because instead of mocking modules, the test can just pass in fake versions of the objects used.
Updated handlers accordingly
Some endpoints error when the specified app has a Helm config, such as getAppLogs, -File

/frontend

Organized components under /components/config and /components/diff
Wrote types for form states and moved config / form state generation and formatting to /lib/form.ts
Wrote placeholders for helm config-related components

To-do

Test redeployments and project selection on anvilops-staging

…loy Helm apps

- Add TARGETARCH buildarg to migration job Dockerfile for local testing - Fix workload migration to use correct appType parameter and sequence starting value - Omit id from Workload and Helm configs to avoid confusion - List all missing env vars - Fix incorrect image registry URL - Ignore not found error when deleting a namespace - Fix various API handlers - Fix async error handling during app validation - Do not await deployment process after validation and creating a Deployment - Update git version

- Write types for the form states of configs of different sources - Add helper functions for form state and config generation - Move source or app type-specific code into separate components - Separate DiffInput into DiffInput and DiffSelect for speed

Tested on an x86_64 system (TARGETARCH=amd64). Works with `docker build` and from Tilt. Should work on 64-bit ARM systems; won't work on 32-bit ARM since Tini's binary naming convention doesn't line up. Source: https://github.com/BretFisher/multi-platform-docker-build

…flictError handler

Not sure if this changes semantics but it matches the convention of the other functions in the file. Maybe try/catch behavior is different?

…tabase

…or error

FluxCapacitor2

Phew! This PR is gigantic. I've looked over everything but I haven't tested it myself yet.

I made some small changes that shouldn't change any behavior. Here is that diff if you'd like to review: https://github.com/PurdueRCAC/AnvilOps/compare/9eebc7979352eaa53f3d0ee9ef962cd7f0daa93f..ec207db68386c72474b82623e8cb45446bcf2883.

General notes:

I really like the idea of data-driven Helm templates that allow us to create forms with JSON and validate with JSON schemas. Great idea.
The refactoring generally looks good and I like the way you're doing dependency injection in src/service/helper/*.
Thanks for splitting off the frontend form stuff into separate files based on configuration area. That makes it a lot nicer to work with.
Administrators should have the ability to disable Helm deployments via environment variable. Maybe even Git and Image deployments too for completeness.
Of course, documentation needs to be updated to explain how administrators configure a Helm OCI repo & how users use the charts.
On the subject of documentation, I think the codebase is separated enough that we should document the directory structure somewhere.

Everything else is in individual review comments.

FluxCapacitor2 · 2026-01-06T05:42:17Z

backend/src/db/repo/deployment.ts

  async create({
    appId,
+    appType,
    config,


Why can't you use config.appType here instead of relying on a separate parameter? If you use config.appType, I think you can take advantage of the discriminated union to get rid of the type casts in this method.

FluxCapacitor2 · 2026-01-06T05:45:51Z

backend/prisma/schema.prisma

+enum AppType {
+  workload
+  helm
+}


We should make the capitalization consistent on all of our enums. Can be addressed in another PR though.

FluxCapacitor2 · 2026-01-06T05:58:36Z

backend/prisma/schema.prisma

+  id               Int             @id @default(autoincrement())
+  deployment       Deployment?
+  appType          AppType
+  workloadConfig   WorkloadConfig? @relation(fields: [workloadConfigId], references: [id], onDelete: Cascade)


I think the @relation should be specified on the WorkloadConfig and HelmConfig models instead of on the DeploymentConfig model. Currently, if the WorkloadConfig is deleted, them the DeploymentConfig is deleted, not the other way around. Is this intended?

I wish we could make the deploymentConfig field in WorkloadConfig and HelmConfig required.

FluxCapacitor2 · 2026-01-06T07:05:22Z

backend/src/lib/helm.ts

+    }
+  }
+
+  return runHelm(args);


I worry about running Helm in the same container as the AnvilOps web server. Ideally, we'd run helm in a K8s Job so that we can lock it down better, similar to what's happening in builder.ts and import.ts. I think Rancher does this too when installing Helm charts, but I haven't checked.

If we want to keep it like this for the sake of simplicity, we have to make sure that Go templates can't be used to run arbitrary code or access sensitive information (including via Sprig, the library that Helm uses for extra template utilities) and can't lead to resource exhaustion via large or circular templates.

FluxCapacitor2 · 2026-01-06T07:08:56Z

backend/src/lib/registry.ts

+
+export async function getRepositoriesByProject(projectName: string) {
+  return fetch(
+    `${env.REGISTRY_PROTOCOL}://${env.REGISTRY_API_URL}/projects/${projectName}/repositories`,


Based on the comments in env.ts,

${env.REGISTRY_PROTOCOL}://${env.REGISTRY_API_URL}

would evaluate to something like

https://https://myregistry.host.name

Either the comment in env.ts:157 should be updated to note that the protocol shouldn't be included (would probably break things elsewhere?), or REGISTRY_PROTOCOL should be removed here.

FluxCapacitor2 · 2026-01-06T08:52:10Z

frontend/src/pages/app/AppView.tsx

          <TabsTrigger value="overview">
            <span>Overview</span>
          </TabsTrigger>
          {!!app.activeDeployment && (


The Status tab should also require a Workload deployment type. It's currently only designed to grab info from the StatefulSet that AnvilOps creates, although we could rework it in the future to work in a more generic way for Helm deployments.

FluxCapacitor2 · 2026-01-06T08:53:47Z

frontend/src/pages/app/ConfigTab.tsx

+  if (!isWorkloadConfig(app.config)) {
+    return (
+      <div className="text-center py-8">
+        <p>Configuration editing is not available for Helm-based apps.</p>


I assume this is temporary since users need a place to edit the Helm chart values, but if not, the whole tab should be hidden just like what I do for the Files and Logs tabs when they don't have any content.

FluxCapacitor2 · 2026-01-06T08:54:24Z

frontend/src/pages/app/FilesTab.tsx

+  if (!isWorkloadConfig(app.config)) {
+    return (
+      <div className="text-center py-8">
+        <p>File browser is not available for Helm-based apps.</p>


Should be unnecessary since the tab is hidden

FluxCapacitor2 · 2026-01-06T08:55:20Z

frontend/src/pages/app/OverviewTab.tsx

+          )}
        <p className="flex items-center gap-2">
          <Network size={16} />
          Internal address


I think the internal address should be hidden too. We don't know what the Service name is, if any.

FluxCapacitor2 · 2026-01-06T09:14:25Z

backend/src/service/helper/deployment.ts

+   *
+   * @throws DeploymentError
+   */
+  private async deployGit({


This method has quite a few responsibilities. For example, there are instances where we call deployGit and it actually doesn't deploy and instead creates a pending check run for a future deployment. Maybe at least the checkRun.pending === true case should be split off into a separate method?

skkra0 added 18 commits October 26, 2025 10:47

Create postgres chart

cfd5a8b

Install from chart URL

cac41e7

Merge branch 'main' into helm

9e1fc81

Move spilo chart to charts

a009231

Merge branch 'main' into helm

e8c32c0

Write API handler for listing custom charts

f2289b6

Add Helm config model

afc4709

Start writing testable deployment controller to handle various app types

c2d329d

Write database migration and refactor createApp/createAppGroup to dep…

2e65b5b

…loy Helm apps

Update backend with helm configs

8945122

Write migration for splitting deployment configs by app type

bea8f84

Merge branch 'main' into helm

359b13a

Move deployment process logic to DeploymentService

fb022de

Fix update and deployment bugs

2f20e98

Fix updateApp, listChart, and helm upgrade

0b527be

Organize config and diff components by app source

5d59f0a

skkra0 force-pushed the helm-backend branch from 39dee7c to b15cd63 Compare January 2, 2026 23:23

Merge branch 'main' into helm-backend

c82babe

skkra0 requested a review from FluxCapacitor2 January 2, 2026 23:28

skkra0 and others added 8 commits January 5, 2026 19:07

Update trigger and image repository

9eebc79

Add generic rethrow in createApp when calling db.app.create after Con…

adc6f4f

…flictError handler

Add explicit await

6872691

Not sure if this changes semantics but it matches the convention of the other functions in the file. Maybe try/catch behavior is different?

Reduce duplicate in preprocessing deployment configs received from da…

8b45bc0

…tabase

Add cast methods that enforce correct config type

de20bbe

Use Promise.allSettled instead of manual try/catch + returning value …

fd41baa

…or error

Small misc. changes

ec207db

FluxCapacitor2 requested changes Jan 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Helm backend #9

Helm backend #9

Uh oh!

skkra0 commented Jan 2, 2026 •

edited

Loading

Uh oh!

FluxCapacitor2 left a comment •

edited

Loading

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

FluxCapacitor2 Jan 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Helm backend #9

Are you sure you want to change the base?

Helm backend #9

Uh oh!

Conversation

skkra0 commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

/chart

/openapi

/backend

/prisma

/db

/lib

/service

/frontend

To-do

Uh oh!

FluxCapacitor2 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

skkra0 commented Jan 2, 2026 •

edited

Loading

FluxCapacitor2 left a comment •

edited

Loading