Local dev mode: k8s-agent local + chart-discovery OCI + Tilt-driven stack by popen2 · Pull Request #94 · platzio/backend

popen2 · 2026-05-23T09:39:59Z

Summary

Establishes a full local development workflow for Platzio with no AWS dependency. Wires the workers to support non-AWS providers and ships the dev harness as a sibling repo (platzio/dev) driven by Tilt + kind.

k8s-agent local mode — `PLATZ_CLUSTER_PROVIDER=local` registers a single cluster from a kubeconfig context instead of scanning EKS across AWS regions. `PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS` is now env-readable.
chart-discovery OCI mode — `PLATZ_REGISTRY_PROVIDER=oci` polls a generic OCI registry (Docker Distribution, zot, ghcr.io, …) instead of watching an SQS-backed ECR event stream. Existing ECR behaviour is the default.
helm pod provider awareness — skips `aws ecr get-login-password` and `HELM_REGISTRY_REGION` for non-ECR registries.
`provider` column on `helm_registries` — new `HelmRegistryProvider` enum, backfilled to `Ecr` via migration.
Dockerfile cargo-chef refactor + `dev` target stage — release path is now cargo-chef + per-arch musl static, with a `--target=dev` stage that keeps cargo + source in the runtime image for Tilt `live_update`.
release workflow refactor — per-arch native runners (amd64 + arm64) push by digest; a follow-up merge job assembles the multi-arch manifest list. Drops QEMU.
local-dev cleanup — removes the old `docker-compose.yaml` + `scripts/run-{api,db,oidc}.sh` setup; README points at `platzio/dev`.

Commit-by-commit

#	Commit	What
1	Switch back to diesel_json from crates.io	(pre-existing)
2	Remove obsolete docker-compose / run-*.sh local dev scripts	cleanup
3	Move local dev to platzio/dev, simplify README	cleanup + README enrichment
4	Add provider column to helm_registries	db
5	chart-discovery: add OCI registry provider mode	feature
6	k8s-agent: skip `aws ecr get-login-password` for non-ECR registries	feature
7	k8s-agent: add local cluster provider mode	feature
8	Refactor Dockerfile to cargo-chef + per-arch musl	build
9	Add dev target stage to Dockerfile	build
10	Refactor release workflow for per-arch native runners	ci

Test plan

`cargo check --workspace` passes (verified locally on this branch)
CI passes (PR validation builds amd64 + arm64 images without pushing)
`cd dev && tilt up` from the sibling `platzio/dev` repo brings the full stack to green
Browser at http://localhost:8080 logs in as `admin@example.com` / `password`
`scripts/seed-charts.sh` in `platzio/dev` publishes the test `hello` chart and chart-discovery picks it up
Production EKS + ECR flow still works (smoke test in a staging cluster before tagging a release)

🤖 Generated with Claude Code

The Tilt-based local stack lives in the sibling platzio/dev repo now and supersedes docker-compose plus the run-{api,db,oidc}.sh helpers. Drop them and the related dex config / buildkitd config / container-build.sh. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Local development now lives in the sibling platzio/dev repo (Tilt + kind). Replace the long Tilt walkthrough with a short pointer there. Keep the genuine backend-doc updates: add platz-resource-sync to the crate list and description, document the PLATZ_CLUSTER_PROVIDER (eks/local) and PLATZ_REGISTRY_PROVIDER (ecr/oci) knobs, note OIDC_* / ADMIN_EMAILS for platz-api, and drop the orphaned Terraform section. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Introduce a HelmRegistryProvider enum (Ecr | Oci, defaults to Ecr for backwards compat) and surface it on HelmRegistry / NewHelmRegistry. region_name() now returns Option<String> since the AWS-region-in-domain trick only applies to ECR. Foundation for both the chart-discovery OCI poller and the helm pod's conditional `aws ecr get-login-password`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

PLATZ_REGISTRY_PROVIDER selects between `ecr` (default, watches an SQS queue fed by ECR push/delete events) and `oci` (polls a generic OCI registry — Docker Distribution, zot, etc. — over HTTP). The OCI poller walks the registry's `/v2/_catalog` and per-repo tag listings, filters to helm-config-media-type artifacts, downloads each chart with `helm pull`, and inserts a HelmRegistry / HelmChart row tagged with HelmRegistryProvider::Oci. ECR config fields (queue + region) are now optional and only required when provider=ecr. add_helm_chart was split into an ECR-specific download path plus a provider-agnostic record_helm_chart so the OCI poller can reuse the row insertion logic. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The helm pod's bootstrap script unconditionally ran `aws ecr get-login-password` and exported HELM_REGISTRY_REGION, which fails for generic OCI registries that aren't backed by ECR. Gate the login step on HelmRegistryProvider::Ecr and only inject HELM_REGISTRY_REGION when HelmRegistry::region_name() yields a value. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

PLATZ_CLUSTER_PROVIDER selects between `eks` (default, scans every AWS region for EKS clusters) and `local` (registers a single cluster from a kubeconfig context). In `local` mode the agent picks the context from PLATZ_LOCAL_CONTEXT or the kubeconfig's current-context, derives a synthetic provider_id (`local:<ctx>`), and writes a row through the same `Cluster::find_or_create_*` path EKS discovery uses. Side car: PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS is now read from the environment in addition to the CLI flag, so the local helm chart values can flip it on without a custom command line. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Restructure the build around cargo-chef so dep compilation is its own cacheable layer that survives source edits. The builder stage now selects the musl target from TARGETARCH (amd64 → x86_64-unknown-linux-musl, arm64 → aarch64-unknown-linux-musl) and writes binaries into a per-arch cache mount, so amd64 and arm64 native runners can build in parallel without fighting over the same target dir. Drop the scripts/container-build.sh detour (already deleted) and the common `apt install musl-tools` stage; everything lives in the Dockerfile now. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Adds a `dev` build target that keeps cargo + workspace source in the runtime image, so Tilt's live_update can re-run `cargo build` inside the running container after syncing edited files. No cache mount on the build step — the warm /build/target dir is baked into the resulting image, which trades image size for a fast first incremental rebuild after `tilt up`. The dev stage isn't referenced by any other stage, so `docker build` without `--target` keeps producing the musl-static release image unchanged. The Tiltfile in platzio/dev explicitly passes `--target=dev`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Build amd64 and arm64 images in parallel on their respective native runners (ubuntu-latest, ubuntu-24.04-arm) instead of cross-compiling under QEMU. Each matrix job pushes its image by digest into Docker Hub (scope-tagged GHA cache per arch), and a follow-up `merge` job stitches the digests into a multi-arch manifest list under the release tag. PR builds only validate (no push, no login). Drop the QEMU and buildkitd-config setup; the latter referenced the deleted .github/buildkitd.toml. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

popen2 and others added 10 commits May 23, 2026 12:33

Switch back to diesel_json from crates.io

82608e3

popen2 merged commit 1d7ada9 into main May 23, 2026
7 checks passed

popen2 deleted the local-dev branch May 23, 2026 10:20

Navigation Menu

Local dev mode: k8s-agent local + chart-discovery OCI + Tilt-driven stack - #94

Local dev mode: k8s-agent local + chart-discovery OCI + Tilt-driven stack#94
popen2 merged 10 commits into
mainfrom
local-dev

popen2 commented May 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Conversation

popen2 commented May 23, 2026

Summary

Commit-by-commit

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant