Fix: Minikube Config by asad-miah · Pull Request #2210 · rhesis-ai/rhesis

asad-miah · 2026-07-21T15:36:35Z

This PR introduces changes from the fix/minikube-config branch.

📝 Summary

📁 Files Changed ( 3 files)

infrastructure/k8s/charts/rhesis/values-local.yaml
infrastructure/k8s/k8s-deploy.sh
infrastructure/k8s/manifests/secrets/rhesis-secrets.yaml.example

📋 Commit Details

bca070031 - fix(dev): resolve local k8s deployment issues in minikube (Md Asaduzzaman Miah, 2026-07-21 17:35)

✅ Checklist

Code follows the project's style guidelines
Self-review of code has been performed
Code is commented, particularly in hard-to-understand areas
Corresponding changes to documentation have been made
Tests have been added/updated for new functionality
All tests pass locally

🧪 Testing

📸 Screenshots (if applicable)

🔗 Related Issues

peqy

Looks good overall—these changes should unblock local minikube deploys (pgvector image + frontend build context + documenting required session secret).

Found 2 nits.

peqy · 2026-07-21T15:42:35Z

+            # Build context must be the repo root (not apps/frontend) so the
+            # Dockerfile can COPY ee/frontend/*, which lives outside apps/frontend.
+            cd "$PROJECT_ROOT" || exit 1
+            docker build -t rhesis-frontend:latest . -f apps/frontend/Dockerfile \


Nit: I’d put the build context . at the end for consistency/compatibility: docker build -t rhesis-frontend:latest -f apps/frontend/Dockerfile . \ --build-arg .... Also, this relies on BuildKit to pick up apps/frontend/Dockerfile.dockerignore—might be worth ensuring BuildKit is enabled (otherwise the root context can get big).

peqy · 2026-07-21T15:42:35Z

  NEXTAUTH_SECRET: <BASE64_ENCODED_NEXTAUTH_SECRET>

+  # Session Secret (required by the backend's native auth — no safe default)
+  # Generate: openssl rand -hex 32


Nit: since this file requires base64-encoded values, consider making the generation hint explicitly produce base64, e.g. openssl rand -hex 32 | base64 | tr -d '\n' (or similar).

akwasigroch · 2026-07-22T12:24:08Z

The minikube deployment guide is missing a few things:

No mention of how/where to configure secrets before deploying
Deployment steps aren't documented (should live in docs/)
How do we deploy all manifests without rebuilding images each time?
Secrets use base64 encoding — could we add a script/helper to encode these instead of doing it manually?

asad-miah · 2026-07-22T12:51:55Z

The minikube deployment guide is missing a few things:

No mention of how/where to configure secrets before deploying

Deployment steps aren't documented (should live in docs/)

How do we deploy all manifests without rebuilding images each time?

Secrets use base64 encoding — could we add a script/helper to encode these instead of doing it manually?

thanks @akwasigroch

The backend migrations require the pgvector extension, which plain postgres lacks. Additionally, the frontend build was failing because the `ee/frontend` directory was outside the build context, and the backend auth requires a session secret that lacked a default.

- Add Kubernetes deployment guide for Minikube in documentation - Add generate-secrets.sh to initialize Minikube secrets safely - Update K8S-DEPLOY-USAGE.md and rhesis-secrets.yaml.example for better local developer experience - Add Kubernetes tab to the main deployment documentation page

peqy · 2026-07-22T18:22:18Z

Improvement: docs/content/docs/deployment/kubernetes.mdx says values-local.yaml is tuned for Minikube with imagePullPolicy: Never, but values-local.yaml sets global.imagePullPolicy: IfNotPresent and Postgres also pulls IfNotPresent (pgvector). Might be worth tweaking the wording to avoid implying the cluster won’t pull anything from a registry.

Overall this is a solid dev UX improvement (secret generation + clearer reset/apply/rebuild flows).

Found 1 issue (0 critical, 1 improvement).

peqy

Critical: apply_all() applies the whole manifests/secrets/ directory, which includes rhesis-secrets.yaml.example. Once the real rhesis-secrets.yaml exists, the example can overwrite it (same Secret name) and blank required keys.

Improvement: Minikube docs claim imagePullPolicy: Never in values-local.yaml, but the file sets global.imagePullPolicy: IfNotPresent and Postgres also uses IfNotPresent.

Found 4 issues (1 critical, 1 improvement, 2 nits).

peqy · 2026-07-22T18:27:13Z

+    create_namespace
+
+    echo -e "${YELLOW}📋 Applying secrets and configmaps...${NC}"
+    kubectl apply -f "$PROJECT_ROOT/infrastructure/k8s/manifests/secrets/" -n "$NAMESPACE"


Critical: kubectl apply -f .../manifests/secrets/ (and configmaps) will also apply the committed *.yaml.example templates.

Once ./generate-secrets.sh creates rhesis-secrets.yaml, you’ll have two Secret manifests with the same metadata.name (rhesis-secrets), and depending on apply order the .yaml.example can overwrite the real secret (blanking required keys).

Fix: apply only the real files (e.g. .../secrets/rhesis-secrets.yaml and .../configmaps/rhesis-config.yaml if present, else the example), or exclude *.example from the apply step / move templates out of the applied directories.

No — this claim is incorrect. I tested it directly rather than relying on assumption:

kubectl apply -f only recognizes files with .yaml, .yml, or .json extensions — .yaml.example is not one of them, so it's never picked up, regardless of what else is in the directory.

Verified three ways:

Directory with both real.yaml and real.yaml.example (same resource name) → only the real value survived.
Directory with only a .yaml.example file → kubectl errored outright: recognized file extensions are [.json .yaml .yml].
Directory with both files but different resource names in each → only the resource from real.yaml appeared in the output; the one from real.yaml.example never showed up at all.
So there's no collision, no apply-order race, and no risk of the example template blanking your real secret. The kubectl apply -f .../manifests/secrets/ / .../manifests/configmaps/ calls in k8s-deploy.sh are safe as written — no fix needed.

You’re right — thanks for testing and spelling it out. kubectl apply -f <dir> only considers .yaml/.yml/.json, so *.yaml.example won’t be applied and there’s no collision/overwrite risk here as long as we keep the .example suffix (and don’t ship templates as *.yaml). I’ll retract my earlier “Critical” concern.

peqy · 2026-07-22T18:27:13Z

+<Callout type="warning">
+**Local Development Only**
+
+The chart ships one values file, `values-local.yaml`, tuned for Minikube (`imagePullPolicy: Never`,


Improvement: This says values-local.yaml is tuned for Minikube with imagePullPolicy: Never, but values-local.yaml currently sets global.imagePullPolicy: IfNotPresent and Postgres also pulls IfNotPresent (pgvector).

Fix: tweak the wording to reflect reality (app images are Never + loaded into Minikube; some dependencies may be pulled) or change the values file to match the statement.

peqy · 2026-07-22T18:27:13Z

-  NEXTAUTH_SECRET: <BASE64_ENCODED_NEXTAUTH_SECRET>
+  JWT_SECRET_KEY: ""
+  NEXTAUTH_SECRET: ""
+  # Generate: openssl rand -hex 32


Nit: Since these values live under Secret.data and must be base64, the generation hint (openssl rand -hex 32) is misleading if someone follows it manually.

Fix: either say “run ../generate-secrets.sh” (preferred) or show a base64-producing one-liner.

peqy · 2026-07-22T18:27:13Z

+            # Build context must be the repo root (not apps/frontend) so the
+            # Dockerfile can COPY ee/frontend/*, which lives outside apps/frontend.
+            cd "$PROJECT_ROOT" || exit 1
+            docker build -t rhesis-frontend:latest . -f apps/frontend/Dockerfile \


Nit: For broader Docker CLI compatibility, put the build context . at the end: docker build -t rhesis-frontend:latest -f apps/frontend/Dockerfile . \ --build-arg ....

- Replace misleading `openssl rand`/Fernet generate hints for SESSION_SECRET_KEY/DB_ENCRYPTION_KEY with a pointer to generate-secrets.sh, since Secret data must be base64-encoded and pasting the raw command output directly would silently corrupt the value. SSO_ENCRYPTION_KEY (not auto-generated) gets a one-liner that generates and encodes in one step. - Put the docker build context last for frontend/backend, matching worker/chatbot/docs and avoiding reliance on flag ordering after a positional path. - Fix kubernetes.mdx's imagePullPolicy claim: only the five app images use Never; Postgres/Redis use IfNotPresent (pulled from mirror.gcr.io).

peqy

Improvement: The new Minikube “Setup” flow is still missing creation of manifests/configmaps/rhesis-config.yaml (copy from .example) before running ./k8s-deploy.sh reset/apply. The chart expects an existing ConfigMap named rhesis-config, so following the guide as written can lead to pods failing with “configmap not found”.

Everything else here is a solid dev UX improvement (secret generation + clearer reset/apply/rebuild flows).

Found 3 issues (0 critical, 2 improvements, 1 nit).

peqy · 2026-07-22T19:40:06Z

+
+## Setup
+
+<CodeBlock filename="Terminal" language="bash">


Improvement: In the “Setup” snippet, consider adding the rhesis-config ConfigMap step before ./k8s-deploy.sh reset (e.g. cp manifests/configmaps/rhesis-config.yaml.example manifests/configmaps/rhesis-config.yaml). The chart expects an existing ConfigMap named rhesis-config, so without this the pods can start failing with “configmap not found” even though reset succeeds.

peqy · 2026-07-22T19:40:06Z

-
-    echo -e "${GREEN}✅ Deployment completed${NC}"
-    echo ""
+# Fail with a pointer to generate-secrets.sh if the real secrets file is missing.


Improvement: apply_all checks for manifests/secrets/rhesis-secrets.yaml, but not for the required ConfigMap file. Since the chart references existingConfigMap: rhesis-config and the repo only commits rhesis-config.yaml.example, it might be worth adding a similar guard (or an auto-copy like secrets) to fail fast with a clear message: “cp manifests/configmaps/rhesis-config.yaml.example manifests/configmaps/rhesis-config.yaml”.

peqy · 2026-07-22T19:40:06Z

+  #    local development. Change only for production.
+  # 3. Optional — ships blank (feature disabled) or with a harmless placeholder,
+  #    matching docker-compose.yml. Set your own with:
+  #    ../generate-secrets.sh encode "your-actual-value"


Nit: Since generate-secrets.sh now exists and the required keys are filled automatically, you could simplify the inline guidance here to just point to that script (and drop the openssl rand ... discussion entirely) to reduce the chance someone tries to hand-generate non-base64 values.

asad-miah self-assigned this Jul 21, 2026

peqy Bot reviewed Jul 21, 2026

View reviewed changes

asad-miah requested a review from akwasigroch July 21, 2026 17:29

asad-miah added 2 commits July 22, 2026 20:13

asad-miah force-pushed the fix/minikube-config branch from a1cf2da to 6f3a8ec Compare July 22, 2026 18:13

peqy Bot suggested changes Jul 22, 2026

View reviewed changes

rhesis-ai deleted a comment from peqy Bot Jul 22, 2026

peqy Bot suggested changes Jul 22, 2026

View reviewed changes

asad-miah marked this pull request as draft August 4, 2026 12:19

Uh oh!

Conversation

asad-miah commented Jul 21, 2026

📝 Summary

📁 Files Changed ( 3 files)

📋 Commit Details

✅ Checklist

🧪 Testing

📸 Screenshots (if applicable)

🔗 Related Issues

Uh oh!

peqy Bot left a comment

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

akwasigroch commented Jul 22, 2026

Uh oh!

asad-miah commented Jul 22, 2026

Uh oh!

peqy Bot commented Jul 22, 2026

Uh oh!

peqy Bot left a comment

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

asad-miah Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot left a comment

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

peqy Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants