Skip to content

Commit 9e118af

Browse files
yashlambaslint
yashlamba
authored and
slint
committed
feat(helm): add migration job; add langfuse secrets
1 parent ebc7254 commit 9e118af

12 files changed

Lines changed: 195 additions & 8 deletions

File tree

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ uv run orcha services start
2525
### 3. Apply database migrations
2626

2727
```bash
28-
uv run orcha init-db
28+
uv run orcha migrate
2929
```
3030

3131
### 4. Start the application
@@ -160,7 +160,7 @@ export OLLAMA_BASE_URL="http://localhost:11434/v1"
160160
|------------------------------------|-------------------------------------------|
161161
| `orcha services start` | Start PostgreSQL + Temporal via Docker |
162162
| `orcha services stop` | Stop all Docker services |
163-
| `orcha init-db` | Apply all database migrations |
163+
| `orcha migrate` | Apply all database migrations |
164164
| `orcha run` | Start server and default-queue worker |
165165
| `orcha run server` | Start FastAPI dev server only |
166166
| `orcha run workers` | Start Temporal worker for default queue |
@@ -174,7 +174,7 @@ The deployed schema is managed with Alembic. Apply committed migrations with:
174174
uv run alembic upgrade head
175175
```
176176

177-
For local setup, `uv run orcha init-db` is a convenience wrapper around the
177+
For local setup, `uv run orcha migrate` is a convenience wrapper around the
178178
same Alembic upgrade.
179179

180180
See [Database Migrations](docs/migrations.md) for the full process of generating

‎app/cli/main.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222

2323

2424
@app.command()
25-
def init_db():
25+
def migrate():
2626
"""Apply all database migrations."""
2727
command.upgrade(Config(PROJECT_ROOT / "alembic.ini"), "head")
2828
typer.echo("Database migrations applied successfully.")

‎charts/orcha/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: orcha
33
description: A Helm chart for Orcha
44
type: application
5-
version: 0.1.0
5+
version: 0.2.0
66
appVersion: "0.1.3"
77

88
dependencies:

‎charts/orcha/README.md‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@ oc create secret generic orcha-llm-secret \
5656
-n <namespace>
5757
```
5858

59+
If Langfuse tracing is enabled:
60+
61+
```bash
62+
oc create secret generic orcha-langfuse-secret \
63+
--from-literal=publicKey='<your-public-key>' \
64+
--from-literal=secretKey='<your-secret-key>' \
65+
-n <namespace>
66+
```
67+
5968
**2. Configure values**
6069

6170
In your `values.yaml` override file:
@@ -66,6 +75,12 @@ secrets:
6675
existingSecret: "orcha-db-secret"
6776
llm:
6877
existingSecret: "orcha-llm-secret" # Omit if not using an LLM API key
78+
langfuse:
79+
existingSecret: "orcha-langfuse-secret" # Omit if Langfuse is disabled
80+
81+
appConfig:
82+
langfuseEnabled: "True"
83+
langfuseBaseUrl: "https://cloud.langfuse.com" # Optional for self-hosted/non-default endpoints
6984
```
7085
7186
### Persistence Configuration
@@ -164,6 +179,17 @@ helm upgrade --install orcha ./charts/orcha \
164179

165180
## Upgrading
166181

182+
Database migrations are run automatically by a Helm hook Job when `migrations.enabled` is true.
183+
The Job runs `orcha migrate`, which applies Alembic migrations to the Orcha database.
184+
It runs on `post-install` and `pre-upgrade`.
185+
186+
Disable automatic migrations with:
187+
188+
```yaml
189+
migrations:
190+
enabled: false
191+
```
192+
167193
```bash
168194
helm upgrade orcha ./charts/orcha \
169195
-f values-<env>.yaml \
@@ -212,4 +238,4 @@ ingress:
212238
tls:
213239
enabled: true
214240
secretName: orcha-tls
215-
```
241+
```

‎charts/orcha/templates/_helpers.tpl‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,13 @@ Create a default fully qualified app name.
2121
{{- end }}
2222
{{- end }}
2323

24+
{{/*
25+
Create the migration job name.
26+
*/}}
27+
{{- define "orcha.migrationJobName" -}}
28+
{{- printf "%s-migrations" (include "orcha.fullname" .) | trunc 63 | trimSuffix "-" }}
29+
{{- end }}
30+
2431
{{/*
2532
Create chart name and version as used by the chart label.
2633
*/}}
@@ -114,6 +121,17 @@ LLM Secret Name
114121
{{- end }}
115122
{{- end }}
116123

124+
{{/*
125+
Langfuse Secret Name
126+
*/}}
127+
{{- define "orcha.langfuseSecretName" -}}
128+
{{- if .Values.secrets.langfuse.existingSecret }}
129+
{{- .Values.secrets.langfuse.existingSecret }}
130+
{{- else }}
131+
{{- "langfuse-secrets" }}
132+
{{- end }}
133+
{{- end }}
134+
117135
{{/*
118136
Temporal Hostname
119137
*/}}

‎charts/orcha/templates/configmap.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ data:
99
AUTH_DISABLED: {{ .Values.appConfig.authDisabled | quote }}
1010
TENANTS_CONFIG_PATH: {{ .Values.appConfig.tenantsConfigPath | quote }}
1111
ALLOWED_ORIGINS: {{ .Values.appConfig.allowedOrigins | quote }}
12+
LANGFUSE_ENABLED: {{ .Values.appConfig.langfuseEnabled | quote }}
13+
{{- if .Values.appConfig.langfuseBaseUrl }}
14+
LANGFUSE_BASE_URL: {{ .Values.appConfig.langfuseBaseUrl | quote }}
15+
{{- end }}
1216
---
1317
apiVersion: v1
1418
kind: ConfigMap

‎charts/orcha/templates/deployment-worker.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,5 +67,21 @@ spec:
6767
key: ollamaApiKey
6868
optional: true
6969
{{- end }}
70+
{{- if or .Values.secrets.langfuse.publicKey .Values.secrets.langfuse.existingSecret }}
71+
- name: LANGFUSE_PUBLIC_KEY
72+
valueFrom:
73+
secretKeyRef:
74+
name: {{ include "orcha.langfuseSecretName" . }}
75+
key: publicKey
76+
optional: true
77+
{{- end }}
78+
{{- if or .Values.secrets.langfuse.secretKey .Values.secrets.langfuse.existingSecret }}
79+
- name: LANGFUSE_SECRET_KEY
80+
valueFrom:
81+
secretKeyRef:
82+
name: {{ include "orcha.langfuseSecretName" . }}
83+
key: secretKey
84+
optional: true
85+
{{- end }}
7086
resources:
71-
{{- toYaml .Values.resources | nindent 12 }}
87+
{{- toYaml .Values.resources | nindent 12 }}

‎charts/orcha/templates/deployment.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,22 @@ spec:
9292
key: ollamaApiKey
9393
optional: true
9494
{{- end }}
95+
{{- if or .Values.secrets.langfuse.publicKey .Values.secrets.langfuse.existingSecret }}
96+
- name: LANGFUSE_PUBLIC_KEY
97+
valueFrom:
98+
secretKeyRef:
99+
name: {{ include "orcha.langfuseSecretName" . }}
100+
key: publicKey
101+
optional: true
102+
{{- end }}
103+
{{- if or .Values.secrets.langfuse.secretKey .Values.secrets.langfuse.existingSecret }}
104+
- name: LANGFUSE_SECRET_KEY
105+
valueFrom:
106+
secretKeyRef:
107+
name: {{ include "orcha.langfuseSecretName" . }}
108+
key: secretKey
109+
optional: true
110+
{{- end }}
95111
{{- if .Values.persistence.tenants.enabled }}
96112
volumeMounts:
97113
- name: tenants-config

‎charts/orcha/templates/migration-job.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{{- if .Values.migrations.enabled }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "orcha.migrationJobName" . }}
6+
labels:
7+
{{- include "orcha.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: migrations
9+
annotations:
10+
"helm.sh/hook": post-install,pre-upgrade
11+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
12+
spec:
13+
backoffLimit: {{ .Values.migrations.backoffLimit }}
14+
{{- with .Values.migrations.ttlSecondsAfterFinished }}
15+
ttlSecondsAfterFinished: {{ . }}
16+
{{- end }}
17+
template:
18+
metadata:
19+
labels:
20+
{{- include "orcha.selectorLabels" . | nindent 8 }}
21+
app.kubernetes.io/component: migrations
22+
spec:
23+
restartPolicy: Never
24+
{{- if .Values.serviceAccount.create }}
25+
serviceAccountName: {{ include "orcha.fullname" . }}
26+
{{- end }}
27+
{{- with .Values.podSecurityContext }}
28+
securityContext:
29+
{{- toYaml . | nindent 8 }}
30+
{{- end }}
31+
containers:
32+
- name: migrations
33+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
34+
imagePullPolicy: {{ .Values.image.pullPolicy }}
35+
command: ["/app/.venv/bin/orcha", "migrate"]
36+
{{- with .Values.securityContext }}
37+
securityContext:
38+
{{- toYaml . | nindent 12 }}
39+
{{- end }}
40+
env:
41+
- name: PGUSER
42+
value: {{ include "orcha.databaseUser" . | quote }}
43+
- name: PGPASSWORD
44+
valueFrom:
45+
secretKeyRef:
46+
name: {{ include "orcha.dbSecretName" . }}
47+
key: password
48+
- name: PGHOST
49+
value: {{ include "orcha.databaseHost" . | quote }}
50+
- name: PGPORT
51+
value: {{ include "orcha.databasePort" . | quote }}
52+
- name: PGDATABASE
53+
value: {{ include "orcha.databaseName" . | quote }}
54+
resources:
55+
{{- toYaml .Values.migrations.resources | nindent 12 }}
56+
{{- with .Values.nodeSelector }}
57+
nodeSelector:
58+
{{- toYaml . | nindent 8 }}
59+
{{- end }}
60+
{{- with .Values.tolerations }}
61+
tolerations:
62+
{{- toYaml . | nindent 8 }}
63+
{{- end }}
64+
{{- with .Values.affinity }}
65+
affinity:
66+
{{- toYaml . | nindent 8 }}
67+
{{- end }}
68+
{{- end }}

‎charts/orcha/templates/secrets.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,29 @@ data:
2929
ollamaApiKey: {{ .Values.secrets.llm.ollamaApiKey | b64enc | quote }}
3030
{{- end }}
3131
{{- end }}
32+
---
33+
{{- $langfuseEnabled := eq (lower (printf "%v" .Values.appConfig.langfuseEnabled)) "true" }}
34+
{{- if not .Values.secrets.langfuse.existingSecret }}
35+
{{- if and $langfuseEnabled (not .Values.secrets.langfuse.publicKey) }}
36+
{{- fail "secrets.langfuse.publicKey is required when appConfig.langfuseEnabled is true and secrets.langfuse.existingSecret is not set" }}
37+
{{- end }}
38+
{{- if and $langfuseEnabled (not .Values.secrets.langfuse.secretKey) }}
39+
{{- fail "secrets.langfuse.secretKey is required when appConfig.langfuseEnabled is true and secrets.langfuse.existingSecret is not set" }}
40+
{{- end }}
41+
{{- if or .Values.secrets.langfuse.publicKey .Values.secrets.langfuse.secretKey $langfuseEnabled }}
42+
apiVersion: v1
43+
kind: Secret
44+
metadata:
45+
name: {{ include "orcha.langfuseSecretName" . }}
46+
labels:
47+
{{- include "orcha.labels" . | nindent 4 }}
48+
type: Opaque
49+
data:
50+
{{- if .Values.secrets.langfuse.publicKey }}
51+
publicKey: {{ .Values.secrets.langfuse.publicKey | b64enc | quote }}
52+
{{- end }}
53+
{{- if .Values.secrets.langfuse.secretKey }}
54+
secretKey: {{ .Values.secrets.langfuse.secretKey | b64enc | quote }}
55+
{{- end }}
56+
{{- end }}
57+
{{- end }}

0 commit comments

Comments
 (0)