Repository navigation
Conversation
…netes * Added configurable images, replicas, services, and environment variables * Configured Kubernetes service discovery between KB, Kaui, and MariaDB * Added startup, readiness, and liveness probes * Updated KB startup script to support configurable DB host * Added Kubernetes service based communication between components
* Fixed Kaui service port mapping * Updated Kubernetes service configuration * Simplified Helm templates and NOTES
Builds on Vijay's Helm chart from #341 (his two commits are kept as is). - Passwords move to a Secret (killbill.adminPassword, database.password), or an existing one via existingSecret. The admin password is now passed as KB_ADMIN_PASSWORD, which the images read. - imagePullSecrets is applied to every Deployment. - Resource names and labels derive from the release name. - database.type selects a bundled MariaDB or PostgreSQL; database.external points Kill Bill and Kaui at an existing server instead. - Bundled databases use the Recreate strategy, an optional storageClass, and a volume that is kept on helm uninstall. - killbill.extraEnv, extraVolumes and extraVolumeMounts (for example, to mount a licence file); kaui.extraEnv. - Kaui probes; 5-second timeouts on the Kill Bill and database probes. - Default images: Kill Bill 0.24.22, Kaui 4.0.31. - Removed unused helm create leftovers; updated Chart.yaml and NOTES.txt. - Added a chart README and a helm_ci workflow (lint and render checks).
- Revert the change to the latest image's startup script and drop DB_HOST. The chart targets versioned images; the latest development image installs plugins on start against a local MySQL. - Kaui and database resource names use the full name cut to 52 characters, so long release names keep every name unique and within 63 characters. - The chart's Secret holds a Kaui session key (kaui-secret-key-base), generated once and reused on upgrades, or set with kaui.secretKeyBase. - A checksum of the chart-managed credentials on the Kill Bill and Kaui pods restarts them when a password changes. - Kill Bill liveness only checks the port, so a database outage does not restart it. The MariaDB probe reads the password from MYSQL_PWD. - database.external.jdbcParameters adds JDBC URL parameters; empty external database names fall back to the defaults. - NOTES.txt warns when the default passwords are in use. - helm_ci: least-privilege permissions, pinned Helm version, checkout v5, and a check that resource names stay unique with a long release name.
- Keep component names unique: a full name over 52 characters is cut to 45 characters plus 6 characters of its hash before the component suffix. - Compute the credentials checksum from a JSON list, so values that contain "|" cannot produce the same checksum. - Kaui startup and readiness probes call "/" over HTTP, so Kaui only receives traffic once it has fully started. - kaui-secret-key-base is required in the Secret, so every Kaui pod signs sessions with the same key. - helm_ci also checks two long release names in one namespace and a fullnameOverride that ends like a component name.
sbrossie
approved these changes
Nov 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Helm chart that deploys Kill Bill, Kaui and a database. It builds on #341 (Vijay's two commits are kept as is) and addresses its open review comments.
Changes on top of #341
killbill.adminPassword,database.password, a generated or setkaui.secretKeyBase), or an existing one viaexistingSecret. The admin password is passed asKB_ADMIN_PASSWORD, which the images read.database.typeselects a bundled MariaDB or PostgreSQL (killbill/mariadb/killbill/postgresql);database.external.*points Kill Bill and Kaui at an existing server, with optionaljdbcParameters.Recreatestrategy, an optionalstorageClass, and a volume that is kept onhelm uninstall.imagePullSecretson every Deployment;killbill.extraEnv,extraVolumesandextraVolumeMounts(for example, to mount a licence file);kaui.extraEnv./; Kill Bill liveness on the port only, so a database outage does not restart it.latestimage's startup script from Added Helm chart for KillBill, Kaui, and MariaDB #341 is reverted: the chart targets versioned images.helm createleftovers; updatedChart.yamlandNOTES.txt(with a warning when the default passwords are in use).helm_ciworkflow: lint, renders of each setup, resource-name checks with long release names, and rejection of an unknowndatabase.type.Testing
All
helm_cichecks also pass locally with Helm 3.16.2.Installed on Docker Desktop Kubernetes:
helm upgrade(database pod replaced)helm upgradewith no changeshelm uninstallNotes
killbill.imageandkaui.image.