feat(kube): replace broken kube/ with working Kustomize manifests

[dnplkndll]

Summary

Replaces the existing broken kube/ manifests (see #181) with a Kustomize-based deployment structure, aligned with the merged Helm chart (#280, #286).

• Closes k8s files to support latest version of Huly #181 (broken kube manifests for v7)
• Addresses Provide a helm chart for kubernetes deployment #20 (Helm/Kustomize support, 34 upvotes)
• Supersedes fix and update kube manifests for v7 #215 (earlier attempt to fix kube manifests)

What changed

kube/
  base/
    config/         # ConfigMap — placeholder domain: huly.example
    infra/          # CockroachDB v24.2, Redpanda v24.3, ES 7.14.2, MinIO
    app/            # 9 Huly services with init containers + readiness/liveness probes
    ingress/        # 6 nginx Ingress resources (path-based routing)
  overlays/
    example/        # Template overlay users copy & customize
  deploy.sh         # One-liner deploy script
  README.md         # Complete deployment guide

Services (13 pods total)

Service	Port	Protocol
front	8080	HTTP
account	3000	HTTP
transactor	3333	WebSocket
collaborator	3078	WebSocket
workspace	—	background
fulltext	4700	HTTP
kvs	8094	HTTP
rekoni	4004	HTTP
stats	4900	HTTP
cockroach	26257	SQL
redpanda	9092	Kafka
elasticsearch	9200	HTTP
minio	9000	S3

Key design decisions

1. Path-based routing (/_accounts, /_transactor, etc.) — matches compose.yml nginx config
2. Elasticsearch 7.14.2 (not OpenSearch) — Huly's elasticsearch-js rejects non-ES backends
3. Explicit env vars on backend services — prevents internal services from getting external URLs
4. Init containers for startup ordering — busybox nc -z wait loops
5. Readiness + liveness probes on all services — aligned with Helm chart defaults
6. No secrets in repo — imperative kubectl create secret
7. huly.example placeholder — users customize via overlay
8. CockroachDB --insecure mode with root user (no password) — matches Helm chart

Alignment with Helm chart

The second commit brings Kustomize manifests to parity with the merged Helm chart:

• KVS service added (pinned to s0.7.392 — hulykvs does not publish a :latest tag)
• Liveness probes on all services, readiness initialDelaySeconds aligned with Helm
• CI workflow fixed: kubectl apply -k, correct deployment names, namespaced commands
• Account: optional GitHub OAuth, OIDC, and DISABLE_SIGNUP env vars
• Transactor: SERVER_CURSOR_MAXTIMEMS
• ConfigMap: DESKTOP_UPDATES_CHANNEL
• Redpanda: pandaproxy + schema-registry args, external listeners, superuser name fix, init container for data dir ownership
• Elasticsearch: 1024m heap, exec-based readiness probe, BITNAMI_DEBUG, removed sysctl init container
• MinIO: liveness probe, PVC increased to 50Gi
• CockroachDB: use root user for --insecure mode (COCKROACH_USER/PASSWORD removed — they have no effect in insecure mode)
• deploy.sh / README: updated secret creation, documented auth providers

Renders

kubectl kustomize kube/overlays/example/ produces 36 resources:

• 13 Deployments (9 app + 4 infra)
• 12 Services
• 6 Ingresses
• 4 PVCs
• 1 ConfigMap

Testing

• kubectl kustomize kube/overlays/example/ renders valid YAML (36 resources)
• Deployed to Hetzner K8s cluster — 13/13 pods Running, 0 restarts
• TLS certificate issued via cert-manager
• Front responds (200), Account API responds (405), createAccount RPC returns token
• All Huly images use latest in base except hulykvs (pinned, no :latest published)
• No provider-specific values in base (storageClassName, domains, emails)

🤖 Generated with Claude Code

[huly-github-staging]

Connected to Huly®: SELFH-277

[ArtyomSavchenko]

Hi @dnplkndll
Could you also check failed Huly deploy step in CI?
https://github.com/hcengineering/huly-selfhost/actions/runs/22860243485/job/66909781849#step:7:63

resource mapping not found for name: "" namespace: "" from "base/ingress/kustomization.yaml": no matches for kind "Kustomization" in version "kustomize.config.k8s.io/v1beta1"
ensure CRDs are installed first
resource mapping not found for name: "" namespace: "" from "base/kustomization.yaml": no matches for kind "Kustomization" in version "kustomize.config.k8s.io/v1beta1"
ensure CRDs are installed first
resource mapping not found for name: "" namespace: "" from "overlays/example/kustomization.yaml": no matches for kind "Kustomization" in version "kustomize.config.k8s.io/v1beta1"
ensure CRDs are installed first

[ArtyomSavchenko]

Could you please verify that changes in .github/workflows/main.yaml match the Huly selfhost configuration?
https://github.com/hcengineering/huly-selfhost/actions/runs/23407104276/job/68087805849?pr=278 is failed due to this error:

* Connected to huly.example (127.0.0.1) port 80
> POST /_accounts/ HTTP/1.1
> Host: huly.example
> User-Agent: curl/8.5.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 107
> 
} [107 bytes data]
< HTTP/1.1 308 Permanent Redirect
< Date: Sun, 22 Mar 2026 16:16:24 GMT
< Content-Type: text/html
< Content-Length: 164
< Connection: keep-alive
< Location: https://huly.example/_accounts
< 
{ [164 bytes data]

100   271  100   164  100   107   109k  73087 --:--:-- --:--:-- --:--:--  264k
* Connection #0 to host huly.example left intact
jq: parse error: Invalid numeric literal at line 1, column 7
Error: Process completed with exit code 5.