Skip to content

Kubernetes & Helm

Purpose

Deploy, verify, and operate AkshayaBazaar on Kubernetes - the local k3d cluster and the real staging/production clusters alike, since both run the exact same Helm chart.

Architecture/context

Traefik (bundled with K3s)
   |
   v
Ingress (one host per environment)
   |
   v
frontend Service --> frontend Deployment (nginx, serves SPA + proxies /api/*)
   |
   v (nginx internal proxy, not a second Ingress hop)
backend Service --> backend Deployment (ASP.NET Core API)
   |
   +--> MySQL (external to the chart - see architecture/infrastructure.md)
   +--> Redis (external to the chart, optional - falls back to in-memory cache)

The backend Service is never reachable via Ingress - only the frontend's nginx reaches it (enforced by NetworkPolicy, not just by omission - see Network Policy).

Files involved

helm/akshayabazaar/
├── Chart.yaml
├── values.yaml                    # base defaults - every values-*.yaml overrides only what differs
├── values-local-staging.yaml      # local k3d
├── values-dev.yaml
├── values-staging.yaml
├── values-production.yaml
├── examples/
│   ├── secret.example.yaml        # shape of the app Secret - never applied by the chart itself
│   └── mysql-backup-secret.example.yaml
└── templates/
    ├── backend-deployment.yaml, backend-service.yaml, backend-configmap.yaml, backend-hpa.yaml
    ├── frontend-deployment.yaml, frontend-service.yaml, frontend-nginx-configmap.yaml, frontend-hpa.yaml
    ├── migration-job.yaml         # pre-install/pre-upgrade Helm hook - EF Core migrations
    ├── ingress.yaml
    ├── networkpolicy.yaml         # 3-4 NetworkPolicy resources (see network-policy.md)
    └── monitoring/, backup/       # disabled by default (monitoring.enabled/backup.enabled: false)

Pages in this section

  • k3d - creating and managing the local cluster.
  • Helm - install/upgrade, secrets, migrations, values files.
  • Ingress - Traefik routing, TLS.
  • Network Policy - the four NetworkPolicy resources and what each allows.
  • Troubleshooting - cluster-level failure diagnosis.

The validated local configuration

Context:      k3d-akshaya-staging
Namespace:    staging
Helm release: akshaya-local
Host:         staging.akshaya.local
Ingress port: 80

.\scripts\verify-staging.ps1 `
  -Context k3d-akshaya-staging `
  -Namespace staging `
  -ReleaseName akshaya-local `
  -IngressHost staging.akshaya.local `
  -IngressPort 80

Expected result: Summary: 14 PASS, 0 WARNING, 0 FAIL. Full detail on what each of the 14 checks verifies: Operations → Verification.