@crewhaus/helm-chart 0.6.0 → 0.7.0

package/dist/index.d.ts

@@ -159,6 +159,23 @@ export type RenderContext = {
     };
 };
 export declare function renderContext(values: ChartValues, releaseName?: string): RenderContext;
+/**
+ * The shapes whose compiled daemon actually opens an HTTP socket and answers
+ * `/healthz` — and therefore the only ones that can carry a Service, an
+ * Ingress and `httpGet` probes.
+ *
+ * NOT the same as "runs continuously". `crew`, `voice` and `browser` are
+ * long-running too, but their bundles contain no `Bun.serve` and no
+ * `/healthz` at all (voice is a stdin/JSONL loop, crew consumes a brief on
+ * stdin and exits), so an `httpGet` probe against them can never pass at any
+ * port. They take the exec probe (`doctor --liveness`) instead, which the
+ * deployment template already renders for every non-HTTP shape.
+ *
+ * Kept in lock-step with the three templates that repeat it inline by
+ * `index.test.ts` — the list used to be duplicated in four places with
+ * nothing checking they agreed.
+ */
+export declare const HTTP_SHAPES: readonly ["channel", "managed"];
 type Node = {
     kind: "text";
     value: string;
@@ -196,6 +213,7 @@ type Node = {
  */
 export declare function renderTemplate(text: string, ctx: RenderContext, defines?: Map<string, Node[]>): string;
 export declare function renderChart(values: ChartValues, releaseName?: string): Record<string, string>;
-/** Daemon shapes that get a Service + Ingress rendered. */
-export declare function isDaemonShape(target: TargetShape): boolean;
+/** Whether this shape serves HTTP, and so gets a Service, an Ingress and
+ *  `httpGet` probes. See {@link HTTP_SHAPES} for why it is only two. */
+export declare function servesHttp(target: TargetShape): boolean;
 export {};

package/dist/index.js

@@ -119,6 +119,17 @@ export function validateValues(values) {
     if (values.service.port <= 0 || values.service.port > 65535) {
         throw new HelmChartError(`service.port out of range: ${values.service.port}`);
     }
+    // `targetPort` is the one that matters and nothing checked it: it becomes
+    // the containerPort, the Service's destination, the port both probes dial
+    // AND — since the chart now emits it as PORT — the port the process binds.
+    // The floor is 1024 rather than 1 because the pod runs as uid 10001 with
+    // every capability dropped, so a privileged port could never be bound and
+    // would fail as a crash loop rather than a validation error.
+    if (!Number.isInteger(values.service.targetPort) ||
+        values.service.targetPort < 1024 ||
+        values.service.targetPort > 65535) {
+        throw new HelmChartError(`service.targetPort must be an integer 1024..65535 (the pod runs unprivileged as uid 10001); got ${values.service.targetPort}`);
+    }
     if (!values.image.tag) {
         throw new HelmChartError("image.tag must be non-empty");
     }
@@ -148,7 +159,23 @@ export function renderContext(values, releaseName = "crewhaus") {
         Chart: { Name: "crewhaus", AppVersion: "1.0.0" },
     };
 }
-const DAEMON_SHAPES = ["channel", "managed", "crew", "voice", "browser"];
+/**
+ * The shapes whose compiled daemon actually opens an HTTP socket and answers
+ * `/healthz` — and therefore the only ones that can carry a Service, an
+ * Ingress and `httpGet` probes.
+ *
+ * NOT the same as "runs continuously". `crew`, `voice` and `browser` are
+ * long-running too, but their bundles contain no `Bun.serve` and no
+ * `/healthz` at all (voice is a stdin/JSONL loop, crew consumes a brief on
+ * stdin and exits), so an `httpGet` probe against them can never pass at any
+ * port. They take the exec probe (`doctor --liveness`) instead, which the
+ * deployment template already renders for every non-HTTP shape.
+ *
+ * Kept in lock-step with the three templates that repeat it inline by
+ * `index.test.ts` — the list used to be duplicated in four places with
+ * nothing checking they agreed.
+ */
+export const HTTP_SHAPES = ["channel", "managed"];
 function tokenise(text) {
     const out = [];
     // Strip helm comments first
@@ -506,7 +533,8 @@ export function renderChart(values, releaseName = "crewhaus") {
     }
     return result;
 }
-/** Daemon shapes that get a Service + Ingress rendered. */
-export function isDaemonShape(target) {
-    return DAEMON_SHAPES.includes(target);
+/** Whether this shape serves HTTP, and so gets a Service, an Ingress and
+ *  `httpGet` probes. See {@link HTTP_SHAPES} for why it is only two. */
+export function servesHttp(target) {
+    return HTTP_SHAPES.includes(target);
 }

package/helm/crewhaus/templates/deployment.yaml

@@ -33,6 +33,15 @@ spec:
           env:
             - name: CREWHAUS_TARGET
               value: {{ .Values.target | quote }}
+            {{- if has .Values.target (list "channel" "managed") }}
+            # The daemon reads PORT; the image bakes its own ENV PORT default
+            # (3000 for channel, 8080 for managed), which used to win and left
+            # the process bound to a port the probes never dialled. Emitting it
+            # here makes service.targetPort the single source of truth for the
+            # containerPort, the Service destination, both probes AND the bind.
+            - name: PORT
+              value: {{ .Values.service.targetPort | quote }}
+            {{- end }}
             {{- if .Values.secrets.anthropic }}
             - name: ANTHROPIC_AUTH_TOKEN
               valueFrom:
@@ -71,7 +80,7 @@ spec:
               value: {{ .Values.otel.headers | quote }}
             {{- end }}
             {{- end }}
-          {{- if has .Values.target (list "channel" "managed" "crew" "voice" "browser") }}
+          {{- if has .Values.target (list "channel" "managed") }}
           ports:
             - name: http
               containerPort: {{ .Values.service.targetPort }}

package/helm/crewhaus/templates/ingress.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.ingress.enabled (has .Values.target (list "channel" "managed" "crew" "voice" "browser")) -}}
+{{- if and .Values.ingress.enabled (has .Values.target (list "channel" "managed")) -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

package/helm/crewhaus/templates/service.yaml

@@ -1,4 +1,4 @@
-{{- if has .Values.target (list "channel" "managed" "crew" "voice" "browser") -}}
+{{- if has .Values.target (list "channel" "managed") -}}
 apiVersion: v1
 kind: Service
 metadata:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/helm-chart",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "Kubernetes Helm chart (templates + values schema + ServiceMonitor + OTel collector sidecar) plus an in-process renderChart() for tests (Section 32)",
   "main": "dist/index.js",
@@ -15,8 +15,8 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/docker-images": "0.6.0",
-    "@crewhaus/errors": "0.6.0"
+    "@crewhaus/docker-images": "0.7.0",
+    "@crewhaus/errors": "0.7.0"
   },
   "license": "Apache-2.0",
   "author": {