Playground Chart
Relevant source files
The following files were used as context for generating this wiki page:
- charts/playground/Chart.yaml
- charts/playground/values.yaml
- charts/playground/templates/ai-secret.yml
- charts/playground/templates/firebase-secret.yml
- charts/playground/templates/playground-deployment.yml
- charts/playground/templates/playground-service.yml
- charts/playground/templates/validations/index.yaml
- charts/playground/README.md
The agh3-playground Helm chart is designed to deploy the ArgusHack3 Playground application. This chart manages the deployment of the playground's frontend container, its associated Kubernetes service, and the configuration of necessary secrets for integration with backend services like Firebase and AI workflows. It is an application-type chart with a dependency on the common library chart for utility functions.
The chart is highly configurable through its values.yaml file, allowing users to enable or disable the playground, specify container images, manage secrets, and define connectivity to backend and AI services. It includes validation logic to ensure that configuration parameters are set correctly based on the chosen deployment strategy.
Sources: charts/playground/Chart.yaml:2-16, charts/playground/values.yaml, charts/playground/templates/validations/index.yaml
Architecture Overview
The Playground chart deploys several Kubernetes resources to run the application. The core component is a Deployment that runs the playground container. A ClusterIP Service exposes the container's web port within the cluster. Additionally, two Kubernetes Secrets can be created to hold configuration for Firebase and AI services, which are then mounted into the playground pod as files.
The following diagram illustrates the high-level architecture of the resources created by this chart.
This diagram shows the relationship between the Kubernetes resources deployed by the chart and their interaction with backend services.
Sources: charts/playground/templates/playground-deployment.yml, charts/playground/templates/playground-service.yml, charts/playground/templates/firebase-secret.yml, charts/playground/templates/ai-secret.yml
Configuration
The chart's behavior is controlled through the values.yaml file. Key configuration sections are detailed below.
Sources: charts/playground/values.yaml, charts/playground/README.md:9-100
Main Playground Configuration
This table summarizes the main parameters under the playground key.
| Parameter | Description | Default Value |
|---|---|---|
playground.enabled | Toggles the deployment of the Playground module. | true |
playground.image.repository | The container image repository for the playground. | leukocyte-lab/argushack3/ctr-playground |
playground.image.tag | The container image tag. | v1.6.12 |
playground.image.pullPolicy | The image pull policy. | IfNotPresent |
playground.extraEnv | A map of additional environment variables to inject into the container. | {} |
Sources: charts/playground/values.yaml:89-100, charts/playground/values.yaml:150-152
Secret Management
The chart can automatically create and manage secrets for Firebase and AI service integration. This is controlled by the playground.secret section.
This diagram shows the flow of creating and using secrets from values.yaml.
Firebase Secret
When playground.secret.firebase.enabled is true, a secret named playground-firebase-secrets is created. This secret contains a firebase.json key with the configuration derived from values.yaml.
| Parameter | Description | Required | Default Value |
|---|---|---|---|
secret.firebase.enabled | Enables the creation of the Firebase secret. | No | true |
secret.firebase.secretName | The name of the Kubernetes secret. | No | playground-firebase-secrets |
secret.firebase.apiKey | Firebase API key. | Yes | "" |
secret.firebase.authDomain | Firebase auth domain. | Yes | "" |
secret.firebase.projectId | Firebase project ID. | Yes | "" |
secret.firebase.storageBucket | Firebase storage bucket. | Yes | "" |
secret.firebase.messagingSenderId | Firebase messaging sender ID. | Yes | "" |
secret.firebase.appId | Firebase app ID. | Yes | "" |
secret.firebase.measurementId | Firebase measurement ID. | No | "" |
The generated secret data has the following structure:
{
"apiKey": "...",
"authDomain": "...",
"projectId": "...",
"storageBucket": "...",
"messagingSenderId": "...",
"appId": "...",
"measurementId": "..."
}
Sources: charts/playground/templates/firebase-secret.yml:1-18, charts/playground/values.yaml:104-113
AI Secret
When playground.secret.ai.enabled is true, a secret named playground-ai-secrets is created. This secret contains an ai.json key with workflow configurations.
| Parameter | Description | Required | Default Value |
|---|---|---|---|
secret.ai.enabled | Enables the creation of the AI secret. | No | true |
secret.ai.secretName | The name of the Kubernetes secret. | No | playground-ai-secrets |
secret.ai.workflows | A list of AI workflows, each with a name and token. | No | [] |
The workflows parameter is an array of objects, for example:
workflows:
- name: "generate-mitigations"
token: "token1"
- name: "generate-mitigation"
token: "token2"
Sources: charts/playground/templates/ai-secret.yml:1-19, charts/playground/values.yaml:117-129
Service and Backend Configuration
The playground.service section defines how the playground connects to its backend API and AI services.
| Parameter | Description | Required | Default Value |
|---|---|---|---|
service.backendRef.kind | The kind of backend service (Service or ExternalService). | Yes | Service |
service.backendRef.name | The name of the backend Service. Required if kind is Service. | Yes (if kind: Service) | captain |
service.backendRef.port | The port of the backend Service. Required if kind is Service. | Yes (if kind: Service) | 8080 |
service.backendRef.protocol | The protocol of the backend Service. Required if kind is Service. | Yes (if kind: Service) | HTTP |
service.backendRef.endpoint | The full URL to the backend if kind is ExternalService, or an optional path prefix if kind is Service. | Yes (if kind: ExternalService) | "" |
service.ai.endpoint | The full URL endpoint for the AI service. | Yes | "" |
Sources: charts/playground/values.yaml:132-148
The chart includes validation logic to enforce these requirements.
This diagram shows the validation logic for the playground.service.backendRef configuration.
Sources: charts/playground/templates/validations/index.yaml:17-49
Kubernetes Resources
Playground Deployment
The playground-deployment.yml template defines a Kubernetes Deployment for the playground application.
- Image: The container image is configured via
playground.imagevalues. - Environment Variables: The container is configured with several environment variables:
NAMESPACE: The Kubernetes namespace where the pod is running.API_ENDPOINT: The calculated endpoint for the backend API, based onplayground.service.backendRefvalues.AI_API_ENDPOINT: The endpoint for the AI service, fromplayground.service.ai.endpoint.AI_API_HOST: The host of the AI service, derived fromAI_API_ENDPOINT.
- Volume Mounts: If Firebase and AI secrets are enabled, they are mounted as read-only files:
firebase.jsonis mounted at/usr/share/nginx/html/api/secrets/firebase.json.ai.jsonis mounted at/usr/share/nginx/html/api/secrets/ai.json.
Sources: charts/playground/templates/playground-deployment.yml:1-57
Playground Service
A simple Kubernetes Service of type ClusterIP is created to expose the playground deployment within the cluster. It maps port 80 to the container's web port (port 80).
# charts/playground/templates/playground-service.yml
apiVersion: v1
kind: Service
metadata:
name: playground
spec:
selector:
app: playground
ports:
- port: 80
targetPort: web
Sources: charts/playground/templates/playground-service.yml:1-10