deploy

Deployment on tethys (deploy/)

What this is

deploy/ is a Kustomize base with everything bring-hermes needs on the tethys cluster: the Deployment, the Service, the public HTTPRoute for bring.meininger.cloud, the CloudNativePG Cluster bring-mcp-db and the ExternalSecret that pulls the token encryption key from OpenBao.

Flux in scramb/tethys watches the master branch of this repo (only deploy/) and applies it into the namespace bring-mcp, impersonating bring-mcp-deployer. Nobody pushes into the cluster from here. tethys keeps what the app must not decide for itself (base-setup/workloads/bring-mcp/ there):

• the namespace bring-mcp,
• the L4 isolation: only the public gateway may connect to the pod,
• the binding: GitRepository, Kustomization and the deployer's rights.

bring-mcp-deployer may manage exactly the kinds that are here -- Deployment, Service, HTTPRoute, ExternalSecret, CNPG Cluster -- in this namespace only. A new kind (a ConfigMap, a ServiceAccount, ...) needs a change of that Role in tethys first; otherwise the Kustomization there turns Ready False with forbidden and the last applied state keeps running.

The Helm chart in helm/ is not used on tethys.

Rollout: bump the tag

1. Cut a release: push a tag X.Y.Z; the Release workflow builds ghcr.io/scramb/bring--mcp:X.Y.Z. Wait until it is green.

2. Change newTag in deploy/kustomization.yaml to X.Y.Z -- never latest, or Git no longer says what runs. New mandatory configuration goes into deployment.yaml in the same commit.

3. Check the render offline, and with a cluster context the diff:

   kubectl kustomize deploy/ >/dev/null
   kubectl diff -k deploy/

4. Commit and push to master. Flux polls every 5 minutes; to apply now:

   flux reconcile kustomization bring-mcp -n bring-mcp --with-source

The schema is created by the app at start (CREATE TABLE IF NOT EXISTS); a release that changes it has to migrate forward on its own.

Check

flux get kustomizations -n bring-mcp
kubectl -n bring-mcp get pods,cluster,externalsecret
curl -s https://bring.meininger.cloud/.well-known/oauth-authorization-server
curl -s -o /dev/null -w '%{http_code}\n' https://bring.meininger.cloud/mcp   # 401

Secrets

Where	What
OpenBao kv/bring-mcp/encryption-key, property key	Fernet key for the Bring! refresh tokens in the database
Secret bring-mcp-db-app	generated by CloudNativePG, read by the deployment

There are no Bring! credentials in the cluster: every user signs in with their own account on the login page. How to write the key is described in tethys, base-setup/secrets/README.md, section 14. Changing it forces every user to sign in once more.